★ delegatecall/call in proposal execution without allowlist

Evidence summary #

Compound Timelock uses target.call{value}(callData) — NOT delegatecall. RD-F-039 criterion for red (delegatecall) is not met. No target allowlist exists (any address can be proposal target via regular call), which is residual governance attack surface but not delegatecall-class risk.

Sources #

Methodology #

Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.

See the full factor methodology and distribution across all protocols →