★ Rescue/emergencyWithdraw without timelock

Evidence summary #

Rescue / emergencyWithdraw without timelock | `submitTransferFees()` in Governance.sol can transfer accumulated message fees to an arbitrary recipient immediately upon valid 13/19 guardian VAA. Effectively functions as a fee-drain path without additional timelock beyond the guardian signing requirement. No `rescue` or `emergencyWithdraw` function found on Token Bridge (Bridge.sol analysis). Fee accumulations are not equivalent to total bridge TVL. | Governance.sol WebFetch (confirming submitT...

Sources #

Methodology #

Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.

See the full factor methodology and distribution across all protocols →