★ Rescue/emergencyWithdraw without timelock
PancakeSwap's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Timelock exists at 0xA1f482Dc (6h delay). MasterChef V2 (CAKE minting authority) uses a Timelock path for changes. However: 6h is extremely thin at $1.73B TVL; current Timelock admin is a dormant EOA (last active Aug 2021); exact coverage of all rescue/emergency paths through this timelock not confirmed. BCE/USDT pool was paused post-exploit manually, suggesting team can make immediate operational changes.
Sources #
- EtherscanPancakeSwap Timelock — BscScanBscScan Timelock 0xA1f482Dc — 6h delay; admin EOA dormantretrieved 2026-04-28
- PancakeSwap BCE/USDT Exploit — CryptoNewsBCE/USDT exploit — pool paused post-incident (suggests team has direct pause authority)retrieved 2026-04-28
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →