Security-Council threshold reduction (RT)
ether.fi's assessment for RD-F-182 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Applicable: EtherFiTimelock (0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761) getMinDelay=3600s (1-hour); Timelock proposer/executor Safe (0xcdd57D11476c22d265722F68390b036f3DA48c21) deployed 2024-02-16, 154 txs. No current threshold reduction event observed. Rated yellow because: (1) 1-hour minimum timelock is already at the lower practical bound — any further reduction collapses exploit window to minutes; (2) Drift Protocol comparator (6-day window between 3/5→2/5 threshold change and $285M exploit) cannot apply here — with 1-hour timelock, exploitation could follow threshold reduction within the same hour; (3) Safe multisig threshold/owners not publicly retrievable (api_status: not_found in data cache), creating a monitoring blind spot. Custom calibration required for production alerting: signal must fire within minutes of threshold-reduction event, not within hours.
Sources #
- Etherscanether.fi Admin Multisig Safe — EtherscanAdmin multisig Safe 0xcdd57D11476c22d265722F68390b036f3DA48c21, deployed 2024-02-16, 154 txsretrieved 2026-04-28
- Drift Protocol $285M exploit — CCNDrift Protocol $285M DPRK exploit Apr 2026 — preceded by 3/5→2/5 SC threshold reduction + timelock removal 6 days beforeretrieved 2026-04-28
- EtherFiTimelock — Etherscan readContractEtherFiTimelock 0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761 getMinDelay=3600retrieved 2026-04-28
Methodology #
Detect in real-time whether the bridge/protocol Security Council multisig executes a threshold reduction (e.g. 3/5 → 2/5), timelock removal, or new-signer addition within ≤14 days of either of those events.
See the full factor methodology and distribution across all protocols →