Timelock duration on upgrades

Concrete's assessment for RD-F-032 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No timelock on upgrades. ConcreteFactory upgrades execute immediately via Safe execTransaction with 0 delay. Data cache timelock_address=null. All 26 Safe transactions are direct execTransaction with no TimelockController interactions. The factory owner can upgrade vault implementations in a single Safe execution.

Sources #

Tx
Factory upgrade — immediate Safe execution, no timelockMarch 19, 2026 factory upgrade tx 0xb0fcfaf: immediate execution via Safe execTransaction — no timelock queuing observedretrieved 2026-05-17
Internal
00-data-cache.json — timelock_address nullData cache: governance.timelock_address=null; safe_multisigs=[]; no timelock identifiedretrieved 2026-05-17

Methodology #

Read the timelock delay (in hours) between a queued upgrade proposal and its executable state.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol concrete factor RD-F-032 score red collected_at 2026-05-17 14:36:59