★ Sudden admin-rescue/ACL change without discussion
Cap (cUSD / stcUSD)'s assessment for RD-F-123 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
§7-rule-5 applied: Cap's publicly-disclosed 3-of-5 dev multisig → 24h Timelock governance is NOT a F123 concealment event — it is disclosed at docs.cap.app/developers/addresses. GitHub PR history (PRs #240–#264) shows no title indicative of a surprise ACL change or admin-rescue: PRs cover oracle adapters (FalconXUSDC, lBTC, market rate), OFT config, contract archival, and dashboard tooling. TimelockController enforces 24h delay on all multisig-initiated changes. YELLOW assigned for the structural executor asymmetry: deployer EOA 0xc1ab5a9593... retains Timelock executor role alongside the dev multisig, creating a unilateral execution path for a single EOA outside Safe quorum. No admin-rescue or ACL change via this path has occurred as of 2026-05-17, but the latent surface is elevated risk relative to a pure-multisig setup. Not red because no concealment event has occurred.
Sources #
- GitHubcap-contracts GitHub PR historyGitHub issues/PRs — PRs #240–#264 reviewed; no ACL change or admin-rescue PR titles foundretrieved 2026-05-17
- 00-profile.md §6 and §11 — Timelock executor rolesProfile §6 and §11 — deployer EOA 0xc1ab5a... retains Timelock executor role; unilateral EOA executor path flaggedretrieved 2026-05-17
- Cap developers addresses — disclosed governancedocs.cap.app/developers/addresses — publicly disclosed governance structure (3-of-5 multisig, Timelock)retrieved 2026-05-17
Methodology #
Determine whether any admin-rescue function or ACL change was committed to the repo or executed on-chain without corresponding public discussion in issues, PRs, or governance forum.
See the full factor methodology and distribution across all protocols →