★ delegatecall/call in proposal execution without allowlist
Midas's assessment for RD-F-039 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No governance proposal executor exists. No on-chain governor or timelock-proposal-executor with arbitrary target execution. TimelockController 0xe3eee3e0 executes only Safe-signed calls — no proposal payload delegation from token holders. PD-042 RWA factor-flip applies.
Sources #
- EtherscanTimelockController — EtherscanTimelockController 0xe3eee3e0: proposer/executor = Safe 0xB60842E9 only; no open proposal submission from token holdersretrieved 2026-05-16
- PD-042 applicationPD-042 RWA factor-flip: no on-chain governor executor for public proposalsretrieved 2026-05-16
Methodology #
Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol midas factor RD-F-039 score not_applicable collected_at 2026-05-16 09:34:55