★ Rescue/emergencyWithdraw without timelock
Beefy Finance's assessment for RD-F-041 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
CRITICAL: (1) panic() in strategy contracts is callable by owner OR keeper (onlyManager modifier) with NO timelock — immediately withdraws all staked funds from external farm to strategy contract and removes all allowances. (2) inCaseTokensGetStuck(address _token) in BeefyVaultV7 is callable by owner (onlyOwner) with NO timelock — immediately transfers all balance of specified non-want token to owner. The 6h vault-level delay covers only upgradeStrat(), not these rescue paths. Strategy contracts owned by dev multisig (3-of-6) can execute panic immediately; vault contracts also owned by dev multisig can rescue non-want tokens immediately.
Sources #
- DocsBeefy Strategy Contract DocumentationBeefy can withdraw all funds out of third party contracts using panic() function; keeper and owner can call panic — no timelock mentionedretrieved 2026-05-16
- BeefyVaultV7.sol — inCaseTokensGetStuck functionBeefyVaultV7.sol inCaseTokensGetStuck() external onlyOwner: transfers token balance to msg.sender with no timelock; excludes want() tokenretrieved 2026-05-16
- BaseAllToNativeFactoryStrat.sol — panic() no timelockBaseAllToNativeFactoryStrat.sol panic() public onlyManager: calls pause() and _emergencyWithdraw() with no timelockretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →