★ delegatecall/call in proposal execution without allowlist

Evidence summary #

Timelock.sol executeTransaction uses call (not delegatecall): target.call.value(value)(callData). No target allowlist enforced. Any address can be called if a VIP passes. The call pattern (not delegatecall) means execution context is the target contract's storage, limiting self-referential damage. Combined with the 1-hour Critical VIP window and guardian cancel capability, assessed as yellow. Not red because delegatecall is the catastrophic variant (Beanstalk class).

Sources #

Methodology #

Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.

See the full factor methodology and distribution across all protocols →