★ delegatecall/call in proposal execution without allowlist
Spark Protocol's assessment for RD-F-039 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Emergency pause/unpause authority held by SparkLend Emergency Multisig. Recovery path documented but centralized — a small group of keyholders can freeze the protocol without governance vote.
Sources #
- Docshttps://docs.spark.fi/dev/security/security-and-auditsretrieved 2026-04-21
Methodology #
Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol spark factor RD-F-039 score yellow collected_at 2026-04-27 01:00:42