defirisk.co
rubric v1.7.0

Rescue/emergencyWithdraw without timelock

Sanctum's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No EVM-style rescue/emergencyWithdraw function exists on Solana. However: program upgrade authority (Squads multisig) can deploy a malicious upgrade with no independent timelock beyond multi-party signing; SPL stake pool manager role can immediately redirect parameters; no emergency withdrawal path with timelock confirmed. Primary risk is the absent timelock on upgrades (F032/F033). Functional rescue analog (upgrade-to-drain) exists but requires multisig coordination, reducing but not eliminating risk.

Sources #

Methodology #

Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol sanctum factor RD-F-041 score yellow collected_at 2026-05-04 18:49:23