★ Rescue/emergencyWithdraw without timelock
Chainlink CCIP's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
OnRamp.sol withdrawFeeTokens() is owner-callable, routes accumulated fee tokens to a designated fee aggregator address. Not a general drain (fixed destination address set in DynamicConfig). No evidence of timelock gating this specific function. Bypasser MCMS can execute break-glass actions with zero delay. Bypasser is a MCMS (multi-party) not an EOA. Yellow: limited rescue surface with non-arbitrary destination, but bypass path has no timelock and is a MCMS, not purely timelocked.
Sources #
- GitHubOnRamp.sol — Code4rena 2024-11-chainlinkOnRamp.sol lines 499-510 — withdrawFeeTokens() owner-callable, routes to feeAggregator from DynamicConfig; no timelock evidence in sourceretrieved 2026-05-16
- smartcontractkit/ccip-owner-contracts READMEccip-owner-contracts README — bypasser role bypasses minDelay in break-glass scenarios via bypasserExecuteBatchretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →