★ Admin = deployer EOA after 7 days
Lombard Finance's assessment for RD-F-043 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Deployer EOA 0x3F6BF1C36CcBb59eAF8415301a0ceC73c344a079 has permanently retained Proxy Admin for LBTC/Consortium/BridgeV2 and PROPOSER_ROLE in LombardTimeLock — well beyond 7 days post-launch (protocol launched August 2024; assessed May 2026 = ~20 months). However, deployer cannot execute without 3-of-5 Safe executing after 1-hour delay, so sole-actor drain is not possible. Assessed yellow for structural concentration, not red.
Sources #
- Etherscanhttps://etherscan.io/address/0x3F6BF1C36CcBb59eAF8415301a0ceC73c344a079retrieved 2026-05-05
- https://etherscan.io/address/0x8236a87084f8b84306f72007f36f2618a5634494retrieved 2026-05-05
- https://etherscan.io/address/0x055E84e7FE8955E2781010B866f10Ef6E1E77e59retrieved 2026-05-05
Methodology #
Determine whether, at t = deploy+7d, the admin address still equals the deployer EOA with no evidence of transfer to a multisig.
See the full factor methodology and distribution across all protocols →