★ Single admin EOA
Lombard Finance's assessment for RD-F-027 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Deployer EOA 0x3F6BF1C36CcBb59eAF8415301a0ceC73c344a079 holds PROPOSER_ROLE in LombardTimeLock and is Proxy Admin for LBTC, Consortium, and BridgeV2 proxies. EOA is still active (last tx 2026-04-24). However, EOA cannot execute alone — EXECUTOR_ROLE is exclusively the 3-of-5 Safe, which executes after the 1-hour TimeLock delay. No single-tx drain path exists for the deployer EOA alone. Assessed yellow rather than red.
Sources #
- Etherscanhttps://etherscan.io/address/0x3F6BF1C36CcBb59eAF8415301a0ceC73c344a079retrieved 2026-05-05
- https://etherscan.io/address/0x8236a87084f8b84306f72007f36f2618a5634494retrieved 2026-05-05
- https://etherscan.io/address/0x055E84e7FE8955E2781010B866f10Ef6E1E77e59retrieved 2026-05-05
Methodology #
Determine whether the effective upgrade/owner/rescue role is held by a single EOA (not a multisig) with no timelock on sensitive operations.
See the full factor methodology and distribution across all protocols →