★ Rescue/emergencyWithdraw without timelock
Midas's assessment for RD-F-041 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
ManageableVault.withdrawToken(address token, uint256 amount, address withdrawTo) is present and callable by any address with vaultRole() (DEPOSIT_VAULT_ADMIN_ROLE for DepositVault, REDEMPTION_VAULT_ADMIN_ROLE for RedemptionVault). No timelock on this function. A compromised vault-admin role-holder can drain vault assets in one transaction without any delay. No timelock guard confirmed in ManageableVault inheritance chain (Sherlock 2024-05 and 2024-08 source both confirm). [★ CRITICAL]
Sources #
- GitHubDepositVault.sol — Sherlock 2024-05DepositVault.sol inherits ManageableVault; no timelock override on withdrawTokenretrieved 2026-05-16
- ManageableVault.sol — Sherlock 2024-08ManageableVault.sol: withdrawToken(address,uint256,address) external onlyVaultAdmin — no timelock, immediately executableretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →