Proposal execution delay < 24h
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor measures the time between a governance proposal passing and when it becomes executable — the internal execution delay, distinct from the voting period. If a proposal that receives the final approving vote can be executed within 24 hours, the community has insufficient time to identify and respond to a malicious proposal that was disguised as benign during the voting period.
Why it matters
The Sonne Finance and Radiant Capital first-incident exploits both involved governance execution windows so short that a prepared attacker could observe the vote result and front-run execution with a malicious transaction. Sonne lost $20M when an attacker front-ran the activation of a new market after the governance proposal passed. Radiant's first incident ($4.5M) involved a 6-second window between market activation and the attacker's donation-exploit transaction. An execution delay under 24 hours gives attackers who monitor governance activity a sufficient window to prepare and execute attacks before defenders can respond.
Green / Yellow / Red
Green is assigned when the time between proposal pass and execution is at least 48 hours, providing the community and automated watchers meaningful response time. Yellow covers 24–48 hours. Red is assigned when the internal execution delay is under 24 hours, meaning a malicious proposal can be executed within one day of passing.
Common gray cases
This factor is grayed when the protocol has no on-chain governance execution (Snapshot-only with manual multisig execution), where execution timing is not mechanically determined.
Notable historical examples
- Sonne Finance ($20M, 2024): Permissionless governance execution after proposal pass; attacker front-ran market activation.
- Radiant Capital (1st incident) ($4.5M, 2024): 6-second window between activation and exploit; no meaningful response time.
Measurement what to look for#
Determine whether the time between a governance proposal passing and its executability (including any internal delay) is less than 24 hours.