Timelock on sensitive actions
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor is a boolean checklist recording whether each sensitive action category — mint, pause, rescue, oracle change, and contract upgrade — is subject to a timelock delay before execution. The result is a per-action boolean map (timelocked: yes/no) rather than a single aggregate score. A protocol that timelocks upgrades but not rescue functions scores partially; the non-timelocked rescue path still represents an immediate drain vector.
Why it matters
Admin action categories have asymmetric risk profiles. A rescue function that bypasses the timelock covering upgrades negates the security value of that timelock entirely — an attacker who gains admin key access can call rescue() immediately while the upgrade mechanism remains protected by a 48-hour delay. The pattern of selective timelock application is common in DeFi protocols that added a governance timelock in response to market pressure but did not apply it consistently across all privileged action categories. The evidence base shows that mint and rescue are the two most frequently bypassed categories.
Green / Yellow / Red
Green is assigned when all five action categories (mint, pause, rescue, oracle change, upgrade) are timelocked with a delay meeting the RD-F-032 threshold. Yellow covers configurations where three or four categories are timelocked and the untimelocked categories are low-severity (pause only). Red is assigned when mint, rescue, or upgrade is executable without any timelock by an admin-level role.
Common gray cases
This factor is grayed when the protocol does not have all five action types (e.g., no mint function on a DEX), in which case only applicable categories are scored and missing categories are noted.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
For each sensitive action category (mint / pause / rescue / setOracle / upgrade), determine whether execution requires going through the declared timelock.