★ Rescue/emergencyWithdraw without timelock

Evidence summary #

Comet.sol exposes approveThis(address manager, address asset, uint amount) and withdrawReserves(address to, uint amount), both callable only by governor (= Timelock in production). approveThis grants approval over any ERC-20 held in Comet; withdrawReserves moves base token reserves. Both require full governance process (GovernorBravo vote + 48h timelock). No single EOA or multisig direct bypass path. Drain capability is real but timelocked through governance (risk captured under RD-F-039).

Sources #

Methodology #

Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.

See the full factor methodology and distribution across all protocols →