Timelock on sensitive actions

Wormhole's assessment for RD-F-033 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Timelock presence on sensitive actions | `submitContractUpgrade()`, `submitNewGuardianSet()`, `submitTransferFees()`, `submitSetMessageFee()`, `submitRecoverChainId()` — all require only a valid 13/19 guardian VAA. None are subject to an on-chain timelock delay post-VAA submission. | Governance.sol via GitHub/WebFetch | **yellow**

Sources #

Curator note
Extracted from 02-governance-admin.md — RD-F-033; no URL citedretrieved 2026-04-28

Methodology #

For each sensitive action category (mint / pause / rescue / setOracle / upgrade), determine whether execution requires going through the declared timelock.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol wormhole factor RD-F-033 score gray collected_at 2026-04-28 01:38:43