Timelock on sensitive actions
StakeWise v3's assessment for RD-F-033 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Zero sensitive actions timelocked. Mint authority (via setController), pause/upgrade (via Safe owner role on Ownable2Step contracts), oracle config (Keeper addOracles/removeOracles), rescue equivalent (emergency controller grant) — all route through 4-of-7 Safe with no timelock. Demonstrated by Nov 2025 Balancer recovery where emergency controller was granted and exercised in a single block sequence.
Sources #
- URLBalancer hacker loses $20M — DL NewsDL News: DAO wallet granted temporary controller, burned tokens, minted equivalent — no timelock preceded actionretrieved 2026-05-16
- OsToken.sol source — GitHub stakewise/v3-coreOsToken.sol: setController() onlyOwner, no TimelockController guardretrieved 2026-05-16
Methodology #
For each sensitive action category (mint / pause / rescue / setOracle / upgrade), determine whether execution requires going through the declared timelock.
See the full factor methodology and distribution across all protocols →