★ Rescue/emergencyWithdraw without timelock
Concrete's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No explicit rescue/emergencyWithdraw function in ConcreteFactory or VaultProxy. However, the factory owner (3-of-5 Safe) can approveImplementation for a malicious vault impl and immediately upgrade any VaultProxy — equivalent to unrestricted fund extraction with no timelock. The absence of an explicit rescue function prevents a red flag, but the upgrade-as-drain vector is the structural concern captured in F032/F033.
Sources #
- GitHubConcreteFactory.sol — no rescue function confirmedConcreteFactory.sol: no rescue/emergency/withdraw function; admin powers limited to approveImplementation, blockImplementation, setMigratable, registerVault, _authorizeUpgraderetrieved 2026-05-17
- VaultProxy.sol — no rescue function confirmedVaultProxy.sol: no rescue/emergency function; upgrade restricted to _admin (ConcreteFactory)retrieved 2026-05-17
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →