★ delegatecall/call in proposal execution without allowlist

Evidence summary #

Emergency pause/unpause authority held by SparkLend Emergency Multisig. Recovery path documented but centralized — a small group of keyholders can freeze the protocol without governance vote.

Sources #

Methodology #

Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.

See the full factor methodology and distribution across all protocols →