Timelock on sensitive actions
Venus Protocol's assessment for RD-F-033 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Mint (VAI): governance VIP path, timelocked. Rescue/sweepToken: Isolated Pools VToken sweepToken to owner() (timelock). Upgrade: Diamond Comptroller via VIP/Timelock. setOracle: ACM-gated. Pause: Guardian multisig can pause immediately (no timelock — intentional emergency mechanism). Pause is untimed by design; all other sensitive actions timelocked. Yellow per taxonomy: 4/5 timelocked (pause is the deliberate exception).
Sources #
- GitHubIsolated Pools VToken sweepToken — transfers to owner() which is timelockisolated-pools/VToken.sol sweepTokenretrieved 2026-04-28
- Governor Bravo — guardian can cancel proposals (pause proxy)GovernorBravoDelegate.sol guardian cancelretrieved 2026-04-28
Methodology #
For each sensitive action category (mint / pause / rescue / setOracle / upgrade), determine whether execution requires going through the declared timelock.
See the full factor methodology and distribution across all protocols →