★ Rescue/emergencyWithdraw without timelock
Balancer (v2 + v3)'s assessment for RD-F-041 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] No timelock on the v2 Vault Authorizer path. Privileged admin functions — fee collection from ProtocolFeesCollector, setting protocol fee percentages, granting/revoking permissions — are executable by the 6-of-11 DAO Multisig without any enforced delay. v3 VaultAdmin pause is executable immediately by Emergency subDAO (3-of-7) with no timelock. The TimelockAuthorizer was built but is DEPRECATED and disconnected from the Vault. Any 6-of-11 consensus (or compromise) can execute immediately with no user exit window.
Sources #
- EtherscanBalancer V3: Authorizer With Adaptor ValidationAuthorizerWithAdaptorValidation — no timelock enforcementretrieved 2026-05-05
- Certora Formal Verification of Balancer TimelockAuthorizerCertora TimelockAuthorizer formal verification — audit of DEPRECATED contract not in live pathretrieved 2026-05-05
- Balancer Deployments — mainnet.json DEPRECATED statusTimelockAuthorizer marked DEPRECATED in deployments registryretrieved 2026-05-05
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →