Hot-patch deploys without timelock (last 30 days)
Yearn Finance's assessment for RD-F-138 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
V3 vault instances are immutable; hot-patch deploys to existing vault instances are impossible by design. TimelockController delay is 7 days. No evidence of timelock bypass in last 30 days. New strategy/periphery deployments via factory are new addresses (not upgrades of existing), and are by-design not gated by timelock.
Sources #
- GitHubyearn-vaults-v3 commit historyyearn-vaults-v3 commit history — no hot-patch commits in last 30 days; last commit Nov 2024retrieved 2026-05-16
- TimelockController events — EtherscanTimelockController 0x88Ba032be87d5EF1fbE87336B7090767F367BF73 — no recent CallExecuted events indicating bypassretrieved 2026-05-16
Methodology #
Count upgrades executed in the last 30 days without going through the declared timelock path.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol yearn-finance factor RD-F-138 score green collected_at 2026-05-16 08:34:32