Hot-patch deploys without timelock (last 30 days)

Axelar Network's assessment for RD-F-138 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

ITS upgrades confirmed as direct bare-EOA calls (0x6f24A47Fc8AE5441Eb47EFfC3665e70e69Ac3F05) with NO timelock. Jul 2025 upgrade tx 0x59a8471b... and Feb 2025 upgrade tx 0x630d798e... both show FROM=0x6f24... (bare EOA) directly calling upgrade() on ITS proxy. No timelock or multisig intermediary confirmed on-chain for any ITS upgrade. The prior 'Unknown [?]' is now resolved to 'NO timelock' for all 6 ITS upgrades.

Sources #

Etherscan
ITS upgrade tx Jul 2025 — direct EOA call confirmedITS upgrade tx Jul 9 2025 block 22884224: FROM=0x6f24A47Fc8AE5441Eb47EFfC3665e70e69Ac3F05 (bare EOA), direct upgrade() call, no intermediaryretrieved 2026-05-17
Etherscan
ITS upgrade tx Feb 2025 — direct EOA call confirmedITS upgrade tx Feb 21 2025 block 21897945: FROM=0x6f24... (bare EOA), upgrade(address,bytes32,bytes) called directlyretrieved 2026-05-17

Methodology #

Count upgrades executed in the last 30 days without going through the declared timelock path.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol axelar factor RD-F-138 score yellow collected_at 2026-05-16 21:57:49