Hot-patch deploys without timelock (last 30 days)

Orca's assessment for RD-F-138 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Squads v4 enforces the 24h on-chain timelock on all upgrade transactions — there is no bypass mechanism in the multisig config. No hot-patch executed without timelock found in the last 30 days. The time_lock field is enforced at the protocol level, not policy-only.

Sources #

Internal
Data cache — Squads v4 on-chain timelock with no bypass pathcache sources.solana_multisigs[0]: verified_time_lock_seconds=86400; no bypass fieldretrieved 2026-05-16
Docs
Squads v4 source — vault PDA System Program ownership by designhttps://github.com/Squads-Protocol/v4retrieved 2026-05-16

Methodology #

Count upgrades executed in the last 30 days without going through the declared timelock path.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol orca factor RD-F-138 score green collected_at 2026-05-16 02:39:16