Timelock duration on upgrades
mETH Protocol's assessment for RD-F-032 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
TimelockController 0xc26016f1166bE7b6c5611AAB104122E0f6c2aCE2 minDelay = 0 seconds (0 hours). Confirmed from Etherscan constructor args: Arg [0]: minDelay (uint256): 0. Zero delay means any queued operation can be executed immediately in the same block as scheduling. No evidence that updateDelay() was called post-deploy (28 total transactions, none identified as updateDelay). At $535M TVS, a zero-delay timelock provides no meaningful execution protection.
Sources #
- EtherscanTimelockController Etherscan — constructor args showing minDelay=0TimelockController 0xc26016... constructor args: Arg[0] minDelay (uint256): 0; confirmed via Etherscan contract creation transactionretrieved 2026-05-16
- mETH Protocol overview docsProfile §6 note: TimelockController minDelay=0 confirmed from constructor args — ANOMALY flagged by profilerretrieved 2026-05-16
Methodology #
Read the timelock delay (in hours) between a queued upgrade proposal and its executable state.
See the full factor methodology and distribution across all protocols →