Timelock on sensitive actions
Pendle Finance's assessment for RD-F-033 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No timelock on: (a) proxy upgrades — ProxyAdmin owner is EOA; (b) router facet updates — owner-callable setSelectorToFacets executes immediately; (c) sPENDLE parameter changes — setCooldownDurationAndFee and setFeeReceiver execute immediately; (d) governance role changes — grantRole/revokeRole on governanceProxy execute immediately.
Sources #
- EtherscanStakedPendle implementation — EtherscanStakedPendle impl 0xA98D1483781c08e60d944a63721b93fe40749032 — setCooldownDurationAndFee, setFeeReceiver — no timelockretrieved 2026-04-29
- ActionStorageV4.sol — router facet adminActionStorageV4.sol setSelectorToFacets() owner-only, no timelock delayretrieved 2026-04-29
Methodology #
For each sensitive action category (mint / pause / rescue / setOracle / upgrade), determine whether execution requires going through the declared timelock.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol pendle factor RD-F-033 score red collected_at 2026-04-28 21:09:40