★ Rescue/emergencyWithdraw without timelock
M^0's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core contracts (MToken, MinterGateway, Registrar, governors, DistributionVault) have no rescue/emergencyWithdraw functions. DistributionVault only has epoch-based claim()/distribute(). Periphery proxies: deployer EOA (proxy admin) can upgrade HubPortal, Portal Lite, SwapFacility to any implementation without timelock — effectively a rescue-equivalent risk via malicious upgrade.
Sources #
- EtherscanDistributionVault — EtherscanDistributionVault source: no admin drain path; epoch-based claim() onlyretrieved 2026-05-16
- HubPortal Proxy — EtherscanSwapFacility proxy admin = EOA; HubPortal owner = EOA last active 2026-05-12; no timelock on upgrade pathretrieved 2026-05-16
- MinterGateway — EtherscanMinterGateway source: no rescue/emergencyWithdraw functions foundretrieved 2026-05-16
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol m0 factor RD-F-041 score yellow collected_at 2026-05-16 09:46:19