★ Rescue/emergencyWithdraw without timelock
Sanctum's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No EVM-style rescue/emergencyWithdraw function exists on Solana. However: program upgrade authority (Squads multisig) can deploy a malicious upgrade with no independent timelock beyond multi-party signing; SPL stake pool manager role can immediately redirect parameters; no emergency withdrawal path with timelock confirmed. Primary risk is the absent timelock on upgrades (F032/F033). Functional rescue analog (upgrade-to-drain) exists but requires multisig coordination, reducing but not eliminating risk.
Sources #
- DocsSquads: Managing Program Upgrades with MultisigSquads V4 documentation: timelock is optional, not mandatory; program upgrades executed with multisig approval onlyretrieved 2026-05-04
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →