★ Rescue/emergencyWithdraw without timelock
BENQI's assessment for RD-F-041 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Compound V2 Comptroller admin can call _reduceReserves(cToken, amount) to drain protocol reserves and _transferComp(address, uint) to sweep COMP-equivalent rewards — both without any timelock delay. No timelock exists across the protocol. Admin multisig can execute reserve drain in a single transaction. sAVAX admin has upgrade authority over the StakedAvax proxy and controls staking parameters without delay. This is a full-drain vector gated only by the undisclosed multisig threshold.
Sources #
- EtherscanBenqi Finance: Comptroller | SnowTraceComptroller on Snowtrace — _reduceReserves and admin control functions visible in Compound V2 ABIretrieved 2026-05-16
- BENQI Security: Audits, Risk Architecture — DEV CommunitySecondary source: no timelock confirmed; unauthorized actor could redirect assets after threshold compromiseretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →