★ delegatecall/call in proposal execution without allowlist

Usual (USD0 / bUSD0 / USUAL)'s assessment for RD-F-039 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No on-chain governance executor contract exists. Multisig executes Safe transactions directly — no proposal execution path involving delegatecall with proposal-supplied targets. Risk is absent by architecture (though the architecture is itself centralized).

Sources #

Internal
Usual data cache — no on-chain governor00-data-cache.json: governance.governor_address = null; governance.type = snapshot_onlyretrieved 2026-05-17

Methodology #

Determine whether the governance executor contract uses `delegatecall` or `call` with proposal-supplied target, without enforcing an allowlist of permitted targets.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol usual factor RD-F-039 score green collected_at 2026-05-16 20:39:44