Hot-patch deploys without timelock (last 30 days)
Frax Finance's assessment for RD-F-138 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
frxUSD has no timelock on admin actions (LlamaRisk confirmed). The April 2, 2026 upgrade was executed without mandatory timelock delay — direct multisig execution path available. Whether this specific upgrade was routed through Omega (2-day veto window) or direct multisig execution is unconfirmed. At minimum, no mandatory timelock delay exists on frxUSD upgrades.
Sources #
- EtherscanFrax USD (frxUSD) | EtherscanfrxUSD proxy 0xcacd6fd2 — upgrade on April 2, 2026; no queued timelock operation foundretrieved 2026-05-17
- Pegkeeper Onboarding Review: Frax frxUSD | Llama RiskLlamaRisk: no timelocks implemented in frxUSD contractsretrieved 2026-05-17
Methodology #
Count upgrades executed in the last 30 days without going through the declared timelock path.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol frax factor RD-F-138 score yellow collected_at 2026-05-16 20:44:31