Signer rotation recency
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor records the number of months since the most recent signer-set change on the protocol's governance multisig — including any addition or removal of a signer, or a change to the threshold. A long-dormant signer set is a stale-key risk: signers who departed the team may retain active keys, and uncirculated keys have an accumulating exposure window. The v1.1 extension notes that the direction of the change matters: a threshold reduction combined with a new signer addition within a short window is a precursor pattern for targeted key compromise attacks.
Why it matters
Signer sets that have not been rotated in 12 or more months represent an operational security gap. Team members depart, key storage disciplines lapse, and the probability of at least one key in a stagnant set being compromised grows over time. The Gala Games exploit involved an admin key that had been dormant for over 30 days, a pattern that correlated with reduced operational vigilance. Force Bridge and OKX DEX both show that decommissioned or stale infrastructure retaining active credential authority is a persistent attacker target.
Green / Yellow / Red
Green is assigned when a signer rotation or threshold review has occurred within the past 12 months, or when the protocol uses a smart-contract-based signer registry with automatic expiry. Yellow covers 12–24 months since last rotation with no evidence of key compromise. Red is assigned when the signer set has not been reviewed or rotated in more than 24 months, or when a recent change shows a threshold reduction without a corresponding security review.
Common gray cases
This factor is grayed when the multisig signer set is not public and on-chain transaction data does not resolve the last-rotation date.
Notable historical examples
- Gala Games ($21.8M, 2024): Admin key dormant for extended period; compromise via unauthorized access to a dormant signing credential.
- OKX DEX ($2.7M, 2023): Deprecated proxy admin key not rotated or revoked; key was live on decommissioned infrastructure.
- Force Bridge ($3.76M, 2025): Key on sunset infrastructure exploited immediately after sunset announcement.
- GANA Payment ($3.1M, 2025): Stale onlyEOA pattern combined with EIP-7702 exploit on nine-day-old protocol.
Measurement what to look for#
Measure the number of months since the most recent signer-set change (add/remove signer) on the admin multisig; flag if threshold was reduced within 14 days of a timelock removal or new-signer addition.