★ delegatecall/call in proposal execution without allowlist

Evidence summary #

No on-chain governor; no governance proposal execution contract. All protocol changes are executed via Root's scheduleRely/executeScheduledRely — a specific structured call, not an arbitrary delegatecall with proposal-supplied target. This pattern eliminates the classic governance-executor attack vector.

Sources #

Methodology #

Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.

See the full factor methodology and distribution across all protocols →