Hot-patch deploys without timelock (last 30 days)
Polymarket's assessment for RD-F-138 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No timelock on upgrade path (UUPS pUSD — onlyOwner, immediate). No hot-patch deploy events identified in last 30 days. Post-April-13 commits are docs-only. No upgrade executed. Rated yellow because the absence of a timelock means any future upgrade would bypass the declared (non-existent) timelock.
Sources #
- GitHubCollateralToken.sol — _authorizeUpgrade onlyOwner, no timelock intermediating upgradePolymarket/ctf-exchange-v2/CollateralToken-authorizeUpgraderetrieved 2026-04-29
- Latest commit April 13, 2026 — docs only; no source changes post-deployPolymarket/ctf-exchange-v2/commits-april-2026retrieved 2026-04-29
Methodology #
Count upgrades executed in the last 30 days without going through the declared timelock path.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol polymarket factor RD-F-138 score yellow collected_at 2026-04-29 16:25:39