Hot-patch deploys without timelock (last 30 days)

Veda (BoringVault)'s assessment for RD-F-138 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

TimelockController with minDelay=0 is the live governance pathway for the verified 3-of-5 Safe. Any admin action by the Safe can be executed without enforced delay. Multiple rapid changes in April–May 2026 occurred with no timelock enforcement. Functionally equivalent to hot-patch capability without timelock.

Sources #

Tx
TimelockController minDelay=0 — hot-patch capabilityTimelockController tx 0x85bd5824: minDelay=0 — zero enforced delay for admin actions; proposer/executor = 3-of-5 Safe 0xD6E47E0F (U18 confirmed)retrieved 2026-05-17

Methodology #

Count upgrades executed in the last 30 days without going through the declared timelock path.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol veda factor RD-F-138 score red collected_at 2026-05-17 12:41:22