★ Sudden admin-rescue/ACL change without discussion
stHYPE (Valantis Labs)'s assessment for RD-F-123 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Two April 2026 admin-side changes: (1) April 7 — multisig signer rotation 3/5 → 4/6 (two signers deprecated, three new added) recorded in roles-and-controls-registry with transaction hashes; (2) April 10 — proxy upgrades with '48-hour timelock' + removal of setSelfDisableTransfer from DEFAULT_ADMIN_ROLE. ValantisLabs X tweet (status/1983210512310804719) is a public upgrade announcement: 'No action is needed by any user/protocol for this upgrade... Details on expansion via Modular CoreWriter can be found in last week's announcement:' — confirming a public pre-announcement existed on X before execution. However: no GitHub issue/PR or governance forum thread found for either change (no forum exists for this protocol). Per §7-rule-5 framing: multisig-only protocol with no DAO/forum means Twitter + docs-registry is the expected communication venue. Yellow (not red) because: public X pre-announcement present; roles-and-controls-registry documents changes with tx hashes; April 10 change was a
Sources #
- URLValantisLabs on X — upgrade announcementValantisLabs X tweet — public upgrade pre-announcement confirming CoreWriter upgrade and prior-week announcementretrieved 2026-05-17
- Roles and Controls Registry | Valantis DocumentationRoles and controls registry — documents April 7 signer rotation (3/5 → 4/6) and April 10 access-control changes with transaction hashesretrieved 2026-05-17
Methodology #
Determine whether any admin-rescue function or ACL change was committed to the repo or executed on-chain without corresponding public discussion in issues, PRs, or governance forum.
See the full factor methodology and distribution across all protocols →