Timelock duration on upgrades
crvUSD (Curve Stablecoin)'s assessment for RD-F-032 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No standalone TimelockController. Aragon vote duration = 7 days (168h) for Ownership votes — this is the functional delay on the DAO path. However, the Deployer 2 EOA admin on ControllerFactory can act immediately (0h delay). The dual-path reality: DAO-routed actions have 168h delay; EOA-direct actions have 0h delay. Graded yellow (not red) because the intended governance path has an adequate delay; red on F033 captures the EOA bypass.
Sources #
- DocsCurve DAO: Governance and VotingCurve DAO docs: voting duration 7 days for all vote typesretrieved 2026-05-16
- Curve DAO: Four years of Aragon governanceAragon article confirms 7-day vote duration for Ownership votes with 30% quorum / 51% supportretrieved 2026-05-16
Methodology #
Read the timelock delay (in hours) between a queued upgrade proposal and its executable state.
See the full factor methodology and distribution across all protocols →