defirisk.co
rubric v1.7.0

delegatecall/call in proposal execution without allowlist

QuickSwap's assessment for RD-F-039 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Not applicable by architecture. No on-chain Governor or executor contract exists. Snapshot proposals are advisory only; the multisig manually executes approved actions. No delegatecall or call in a proposal execution path exists in QuickSwap's governance architecture.

Sources #

  • Internal
    QuickSwap Profile §6 — No on-chain executor.research/protocols/quickswap/00-profile.md §6: governance.type=snapshot_only, no on-chain Governor or Timelockretrieved 2026-05-16
  • Internal
    QuickSwap Data Cache — no Governor.research/protocols/quickswap/00-data-cache.json confirms no Governor contract foundretrieved 2026-05-16

Methodology #

Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol quickswap factor RD-F-039 score green collected_at 2026-05-16 08:48:31