★ Rescue/emergencyWithdraw without timelock
Venus Protocol's assessment for RD-F-041 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Isolated Pools VToken sweepToken: require(msg.sender == owner()) → sends to owner() (timelock). Core Pool admin functions (_reduceReserves, etc.) route through Timelock via VIP execution. No direct EOA-callable fund drain found in verified source. Yellow because 30+ Core Pool vToken admin assignments not individually verified; old Compound v2 delegator pattern admin chain less transparent than new OZ Upgradeable.
Sources #
- GitHubTimelock.sol — target.call.value(value)(callData); no allowlist; call not delegatecallTimelock.sol executeTransactionretrieved 2026-04-28
- Isolated Pools VToken sweepToken — transfers to owner() which is timelockisolated-pools/VToken.sol sweepTokenretrieved 2026-04-28
Methodology #
Determine whether a `rescue(…)` or `emergencyWithdraw(…)` function exists callable by admin without a timelock delay on execution.
See the full factor methodology and distribution across all protocols →