★ Rescue/emergencyWithdraw without timelock

Evidence summary #

Bridge2 has invalidateWithdrawals() (cold validator 2/3 quorum — can cancel pending withdrawals of any user) and emergencyUnlock() (cold validator 2/3 quorum). No timelock on either. Cold validator set is primarily Hyperliquid Labs-controlled. Quorum requirement provides meaningful resistance vs. single-key rescue. Yellow not red because the 2/3 cold-validator quorum is a real barrier.

Sources #

Methodology #

Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.

See the full factor methodology and distribution across all protocols →