★ Sudden admin-rescue/ACL change without discussion
Marinade Finance's assessment for RD-F-123 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
The 2023-Q4 upgrade (Anchor v0.27, emergency pause mechanism, redelegate instruction) was announced via blog post before multisig execution (Safety First blog, Oct-Nov 2023). Oct-4 2023 blog announced intent to transfer upgrade authority from Coral Multisig to Realms. These announcements constitute prior public discussion. However: (a) the emergency pause manager role (noted as hot wallet in Neodyme 2023 audit) was added without a standalone governance proposal or Realms vote; (b) the upgrade itself was ratified by 6/13 Coral Multisig, not an MNDE holder vote; (c) status of authority transfer completion is unconfirmed. Yellow: discussion existed pre-upgrade (blog-driven) but governance vote (Realms) was not the execution mechanism. No evidence of silent ACL change with zero prior discussion (which would be red).
Sources #
- GitHubClosed pull requests - marinade-finance/liquid-staking-programPR #8 anchor-0.27 merge Nov 14 2023 in liquid-staking-program; no corresponding Realms vote foundretrieved 2026-05-16
- Marinade governance update: An upgraded liquid staking contract controlled by the DAOOct-4 2023 blog announcing upgrade authority transfer plan from ecosystem multisig to MNDE holdersretrieved 2026-05-16
- Safety First: Marinade is preparing an upgrade to its liquid staking smart contractSafety First blog announcing Q4-2023 upgrade including emergency pause before multisig signingretrieved 2026-05-16
Methodology #
Determine whether any admin-rescue function or ACL change was committed to the repo or executed on-chain without corresponding public discussion in issues, PRs, or governance forum.
See the full factor methodology and distribution across all protocols →