Hot-patch deploys without timelock (last 30 days)
stHYPE (Valantis Labs)'s assessment for RD-F-138 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
April 9 2026 stHYPE upgrade (within last 30 days) executed without any TimelockController. Safe.execTransaction directly triggered Upgraded event with no timelock contract in the call chain. AccessControl delay = 0 confirms no enforced delay. All upgrades in protocol history follow this pattern.
Sources #
- DocsstHYPE Roles and Controls Registrydocs.valantis.xyz/stakedhype/roles-and-controls-registry — 'AccessControlDefaultAdminRules is initialized with delay 0 in current deployments'retrieved 2026-05-17
- HyperEVMScan — April 2026 upgrade transactionhyperevmscan.io tx 0x11482a6a — Safe execTransaction → Upgraded event; no TimelockController in call chain; April 9 2026retrieved 2026-05-17
Methodology #
Count upgrades executed in the last 30 days without going through the declared timelock path.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol staked-hype factor RD-F-138 score red collected_at 2026-05-17 13:02:38