★ Rescue/emergencyWithdraw without timelock
Circle USYC's assessment for RD-F-041 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[CRITICAL] sweep(address _token, uint256 _amount, address _recipient) exists on YieldCoin (Ethereum implementation 0xBF0f2F3a) and Teller implementation (0xF8724D6b). Callable by owner (EOA) directly with no timelock. A single tx from the owner EOA can drain all protocol-held assets. Both contracts have been confirmed as UUPS-upgradeable, adding a second drain vector via malicious upgrade.
Sources #
- EtherscanTeller implementation - sweep function confirmedTeller implementation 0xF8724D6b sweep function in ABIretrieved 2026-05-16
- YieldCoin implementation - sweep function confirmedYieldCoin 0xBF0f2F3a ABI includes sweep(address,uint256,address) as admin functionretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol circle-usyc factor RD-F-041 score red collected_at 2026-05-15 21:56:43