★ Rescue/emergencyWithdraw without timelock
Yearn Finance's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No classic rescue()/emergencyWithdraw() function in V3 VaultV3.vy. EMERGENCY_MANAGER role triggers vault shutdown (withdrawal-only mode — strategies return funds gradually; cannot instantly drain). This role is assigned by role_manager (ychad-controlled) without individual vault-level timelocking. V2 vaults: immutable, no rescue path. Not a direct drain vector but no timelock gates the role assignment enabling shutdown. Yellow rather than green because role assignment is not timelocked.
Sources #
- GitHubYearn V3 TECH_SPEC.mdTECH_SPEC.md — EMERGENCY_MANAGER triggers shutdown (withdrawal-only), not drainretrieved 2026-05-16
- VaultV3 Contract Docs — Yearn DocsVaultV3 contract docs — EMERGENCY_MANAGER role definitionretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →