Hot-patch deploys without timelock (last 30 days)

Meteora's assessment for RD-F-138 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Squads v3 structural constraint: all upgrades execute without on-chain timelock. Whether any recent upgrade was an out-of-band hot-patch (bypassing normal proposal flow) is not distinguishable from normal upgrades without on-chain upgrade event history. DBC Protocol v0.1.8 released January 21, 2026. Not confirmed as hot-patch; audit coverage exists for v0.1.8 (Offside Labs, Zenith). Yellow because the 0-hour timelock means every upgrade is technically immediately executable.

Sources #

Internal
Solana Governance Verification MethodologySOLANA_GOVERNANCE.md — Squads v3 no timelock; all upgrades immediate after thresholdretrieved 2026-05-16
URL
DBC Protocol v0.1.8 ReleaseDBC SDK v1.5.0 and Protocol v0.1.8 release note — January 21, 2026retrieved 2026-05-16

Methodology #

Count upgrades executed in the last 30 days without going through the declared timelock path.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol meteora factor RD-F-138 score yellow collected_at 2026-05-16 10:03:05