Hot-patch deploys without timelock (last 30 days)
Raydium's assessment for RD-F-138 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No evidence of hot-patch deploys bypassing the Squads 24h timelock in the last 30 days. The Nov 2025 CPMM audit fix commit followed the Sec3 Q3 2025 audit process and was deployed through the documented Squads multisig upgrade path. All program changes go through the 3/4 Squads multisig with 24h timelock.
Sources #
- GitHubRaydium CPMM (cp-swap) commit historyapi.github.com/repos/raydium-io/raydium-cp-swap/commitsretrieved 2026-04-29
- Raydium Protocol Security Documentationdocs.raydium.io/raydium/protocol/securityretrieved 2026-04-29
Methodology #
Count upgrades executed in the last 30 days without going through the declared timelock path.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol raydium factor RD-F-138 score green collected_at 2026-04-29 12:31:55