{ "schema": "pacta.counterparty_control_index.v1", "generated_at": "2026-11-13T10:05:00Z", "publisher": { "organization": "Fractal Neurons", "unit": "Pacta Protocol Commitments DRI", "portal_url": "https://pacta.wtf/", "repository_url": "https://github.com/Fractal-Neurons/pacta", "security_contact": "pacta@dri.network", "attester_eoa": "0xcA4E2ff22B69A7284210c47BdeE21Aac1269da09", "attester_basename": "pacta.base.eth", "treasury_admin": "0x4348DF1BEFAffcbA248B5118B1b782B1B2bdEd14" }, "onchain_anchoring": { "chain_id": 8453, "network": "base-mainnet", "attester_basename": "pacta.base.eth", "attester_eoa": "0xcA4E2ff22B69A7284210c47BdeE21Aac1269da09", "treasury_admin": "0x4348DF1BEFAffcbA248B5118B1b782B1B2bdEd14", "commitment_registry": "0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872", "basescan_url": "https://basescan.org/address/0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872", "sourcify_url": "https://sourcify.dev/#/lookup/0x35D21Bb4Df6586FE7759b5e57263ffeB3e1fd872", "registry_deploy_tx": "0xbbd6cbdd6980c8d99e00ede04259df13c839a005eb611678f9d3a3efd892064f", "registry_batch_tx": "0x1be31c238cb0f9a196b1ed1f654e5e8c377442e3181c205a5c33d95c4b9cdf79", "basename_register_tx": "0x89de213d0d220148ed750c89fbcb7a2a2df8a5fd962ee0d7bf5448fee2e205d4", "eas_schema_registry": "0x4200000000000000000000000000000000000020", "eas_contract": "0x4200000000000000000000000000000000000021", "eas_schema_uid": "0x7ff485bc1159dff3c70eefcb9dff2d65be990301760c2d53799e5a45e3badf83", "eas_schema_url": "https://base.easscan.org/schema/view/0x7ff485bc1159dff3c70eefcb9dff2d65be990301760c2d53799e5a45e3badf83", "eas_schema_register_tx": "0x3ff42fe681156dff4c0d10779cc637f48dab30eacef9e26c549fe6bd2e0cee80", "eas_multi_attest_tx": "0x8c53e155a4b2f28ffbf069f1b65952fc8f7d81740f362b8aafb39493c6bd001b", "sprint_eas_attestations": { "1": "0x34049a2c64fe3355f8e325481234754c8422a48bb4784fed1d028fa40eb93058", "2": "0xca4b525bf5142d8e88433cbed2a1aa87bb06a97d1353cb77621ec41a51ce8101", "3": "0x291e513f3d697eea41b20bd57bf53acdb085b5566e499dd655ff46d7cd9d95a8", "4": "0xa26f81b0e68248c7f286527286b3d2e6b299502d53f4dfbc4397df7d22262986", "5": "0x804289d4357b0a8d5a360911ec450c13ca36c4422d1e811c4c7040ef7d2628e5", "6": "0x749d96e1a3d214a4ab66c528ca12c84dce085fa138dc370dd0eb817d890f09fa", "7": "0x3e0e0e1b62de65b277b1399f9833cd70baf627e5ba69e17f1f4f76be30008779", "8": "0xfd7ce0f2b980da6606c8cd755da45d99f9ae4826e6df1321ff52c2b0f8e6a6c2", "9": "0x0e017bc4399101f9fef3d98a434dd9f2829b6e386e7733408dfd4b626d186eea", "10": "0xfdd83c8091ef6e8ffe67e8a55a78892fcfbb1092683b21ff2d85f8cc09750e6c", "11": "0x754edd7612258b755ff2e56903243d1f8867bad53c29ce3febb5ed9114005e42", "12": "0x7caae9c22c86ae171392def07dce83fa5da6fbf904b1ba9b5ff66a5021b16de9" } }, "methodology": { "chain_id": 1, "network": "ethereum-mainnet", "archive_rpc_endpoints": [ "https://gateway.tenderly.co/public/mainnet", "https://rpc.mevblocker.io" ], "scanner_replay": "Dual-RPC deterministic archive eth_call / eth_getStorageAt replay performed by scanner/leader seats at the cited block height and canonical block hash.", "independent_verifier_scope": "Offline static ABI 4-byte selector derivation, EIP-55 checksum verification, EIP-1967 slot derivation, arithmetic consistency, and whole-token quarantine review performed by isolated verifier seat (offline verifier container does not execute live network RPC calls).", "quarantine_policy": "Directly callable state mutations, unrevoked legacy EOA authorities, and exploit-sensitive findings are excluded from this public feed and routed privately at $0 cost to official protocol security contacts.", "delay_field_semantics": "When observed_delay_seconds is non-null, observed_delay_source specifies the exact contract, 4-byte selector, and getter signature returning that integer delay at the pinned block height; both fields are null where the record evaluates role membership, proxy slots, fee basis points, or non-timelocked ownership.", "scope_limitation": "Entries report sampled historical read-only getter/slot returns alongside cited documentation; they do not certify protocol-wide immutability, exhaustive authority coverage, downstream mutation semantics, or exploitability." }, "summary_metrics": { "sprints_completed": 12, "records_indexed": 32, "parameter_deltas": 13, "protective_deltas": 2, "aligned_baselines": 17 }, "entries": [ { "id": "stader-ethx-manager-safe-and-timelock", "protocol": "Stader Labs (ETHx)", "category": "Liquid Staking", "sprint": 12, "block_number": 26403676, "block_hash": "0xf4246ca23c4c38d520de16080a11b5186d04c8242b2c85edcb04c455d291c3ae", "classification": "parameter_delta", "surface": "Manager Safe Quorum & 7-Day TimelockController Admin Path", "target_contract": "0xAAfb31780e4b9c95Bc920e388f4925A874cd07AF", "target_label": "Stader Manager Safe", "check_type": "eth_call", "selector_or_slot": "0xe75235b8", "onchain_observed": "Manager Safe (0xAAfb31780e4b9c95Bc920e388f4925A874cd07AF) getThreshold() = 3, getOwners().length = 6 (3-of-6 Gnosis Safe); ETHx (0xA35b1B31Ce002FBF2058D22F30f95D405200A15b) EIP-1967 admin slot = ProxyAdmin (0x67B12264Ca3e0037Fc7E22F2457b42643a04C86e), owner() = TimelockController (0x1112D5C55670Cb5144BF36114C20a122908068B9, getMinDelay() = 604800s / 7d, PROPOSER_ROLE held by 6-of-9 Community Safe 0x45B977CeCB9Dfaa17dFcBa88826ef684b8489fF6), which also holds DEFAULT_ADMIN_ROLE on ETHx and StaderConfig (0x4ABEF2263d5A5ED582FC9A9789a41D85b68d69DB); ETHx MINTER_ROLE held by StakePoolsManager (0xcf5EA1b38380f6aF39068375516Daf40Ed70D299), totalSupply = 58,434.16 ETHx (18 dec).", "documented_reference": "staderlabs.gitbook.io/ethereum states 'The Manager multisig is a 3-of-5 and is tasked with maintaining the protocol' and specifies a 7-day minimum delay on contract upgrades.", "observed_delay_seconds": 604800, "observed_delay_source": { "contract": "0x1112D5C55670Cb5144BF36114C20a122908068B9", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 604800, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-12/block-26403676-summary.md", "summary_sha256": "0x66205001b915f64cb7154d4f3d8643ea60348e6460bff476ff3f1fc6e7a60b26", "base_eas_uid": "0x7caae9c22c86ae171392def07dce83fa5da6fbf904b1ba9b5ff66a5021b16de9" }, { "id": "curve-crvusd-factory-lending-owner-proxy", "protocol": "Curve Finance (crvUSD)", "category": "Decentralized Stablecoin & Lending", "sprint": 11, "block_number": 26403523, "block_hash": "0xfc7beaa2338e8054577c0b101b641bc42afca2af39cb85d3fc13cbee32d4681a", "classification": "parameter_delta", "surface": "ControllerFactory Admin Proxy & EmergencyDAO Debt-Ceiling Guard", "target_contract": "0xC9332fdCB1C491Dcc683bAe86Fe3cb70360738BC", "target_label": "crvUSD ControllerFactory", "check_type": "eth_call", "selector_or_slot": "0xf851a440", "onchain_observed": "ControllerFactory (0xC9332fdCB1C491Dcc683bAe86Fe3cb70360738BC) admin() = LendingOwnerProxy (0xeDA020b067872717901916a3B8C724C21f6080d1), where dao() = CurveOwnershipAgent (0x40907540d8a6C65c637785e8f8B742ae6b0b9968, Aragon voteTime = 604800s / 7d on 0xE478de485ad2fe566d49342Cbd03E49ed7DB3356) and emergency_dao() = 5-of-9 EmergencyDAO Safe (0x467947EE34aF926cF1DCac093870f613C96B1E0c); crvUSD (0xf939E0A03FB07F59A73314E73794Be0E57ac1b4E) minter() = ControllerFactory, totalSupply = 2,134,809,204.98 crvUSD; debt_ceiling(0x370a449FeBb9411c95bf897021377fe0B7D100c0) = 1,000,000,000 crvUSD.", "documented_reference": "curvefi/docs docs/developer/crvusd/factory.md states 'Only its admin, the CurveOwnershipAgent, can call to add a market'; LendingOwnerProxy intermediate wrapper added at block 26300155.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-11/block-26403523-summary.md", "summary_sha256": "0xc4a599ac19a79b5e24627692ccfc0431ba231ab8bea24236b8b876b5605ebaa8", "base_eas_uid": "0x754edd7612258b755ff2e56903243d1f8867bad53c29ce3febb5ed9114005e42" }, { "id": "gearbox-v3-legacy-timelock-and-instance-safe", "protocol": "Gearbox V3 / V3.1", "category": "Leveraged Credit & Curated Lending", "sprint": 11, "block_number": 26403523, "block_hash": "0xfc7beaa2338e8054577c0b101b641bc42afca2af39cb85d3fc13cbee32d4681a", "classification": "parameter_delta", "surface": "LegacyTimelock Delay & InstanceManager Safe Quorum", "target_contract": "0xa133C9A92Fb8dDB962Af1cbae58b2723A0bdf23b", "target_label": "Gearbox LegacyTimelock", "check_type": "eth_call", "selector_or_slot": "0x6a42b8f8", "onchain_observed": "LegacyTimelock (0xa133C9A92Fb8dDB962Af1cbae58b2723A0bdf23b) delay() = 129600s (36 hours, GIP-104), admin() = LegacyGovernor (0x29B97F37B3E0C704bCFD785F5b7bBa2A0B7df2c7); InstanceManager (0x77777777144339Bdc3aCceE992D8d4D31734CB2e) owner() = 4-of-21 Gnosis Safe (0x1E9ec044853611F4bCD4BBcFE7657508BD1c53D3); Tech (0xA7D5DDc1b8557914F158076b228AA91eF613f1D5, 6-of-12), Veto (0xbb803559B4D58b75E12dd74641AB955e8B0Df40E, 4-of-12), Treasury (0x7b065Fcb0760dF0CEA8CFd144e08554F3CeA73D1, 5-of-10), and Fee (0x3E965117A51186e41c2BB58b729A1e518A715e5F, 5-of-10) Guard Safes match documented thresholds.", "documented_reference": "docs.gearbox.finance states technical changes are 'behind a 2-day timelock' (172800s) and lists InstanceManager multisig as '4-of-12 (Subject to chain-specific configuration)'.", "observed_delay_seconds": 129600, "observed_delay_source": { "contract": "0xa133C9A92Fb8dDB962Af1cbae58b2723A0bdf23b", "selector": "0x6a42b8f8", "getter": "delay()" }, "documented_delay_seconds": 172800, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-11/block-26403523-summary.md", "summary_sha256": "0xc4a599ac19a79b5e24627692ccfc0431ba231ab8bea24236b8b876b5605ebaa8", "base_eas_uid": "0x754edd7612258b755ff2e56903243d1f8867bad53c29ce3febb5ed9114005e42" }, { "id": "ondo-ousg-rate-limiter-and-flux-timelock", "protocol": "Ondo Finance (OUSG & Flux Finance)", "category": "Institutional RWA / Tokenized Treasuries", "sprint": 10, "block_number": 26403121, "block_hash": "0x71acee2313a2c8eacd7d2c87667dc505310b3e9224d84eaebb71d5a890ef9d1c", "classification": "parameter_delta", "surface": "OUSG RateLimiter Global Subscription Limit & Flux 1d Timelock", "target_contract": "0x98Db502215Da1ad9F626D4a0090A8A2f4971003c", "target_label": "Ondo RateLimiter", "check_type": "eth_call", "selector_or_slot": "0x435e3a08", "onchain_observed": "RateLimiter (0x98Db502215Da1ad9F626D4a0090A8A2f4971003c) globalSubscriptionLimits(0x1B19C19393e2d034D8Ff31ff34c81252FcBbee92) word [2] = 100000000000000000000000000 ($100M per 86400s window), globalRedemptionLimits(OUSG) word [2] = 50000000000000000000000000 ($50M per 86400s); Flux Comptroller (0x95Af143a021DF745bc78e845b54591C53a8B3A51) admin() = FluxTimelock (0x2c5898da4DF1d45EAb2B7B192a361C3b9EB18d9c, delay() = 86400s / 1d, admin() = 0x336505EC1BcC1A020EeDe459f57581725D23465A); OUSG totalSupply = 1,110,569.33 OUSG.", "documented_reference": "docs.ondo.finance/qualified-access-products/ousg/instant-limits.md states 'Instant minting has a $50M Global Limit' and 'Instant redemptions have a $50M Global Limit'; Flux docs specify 1-day Timelock governance.", "observed_delay_seconds": 86400, "observed_delay_source": { "contract": "0x2c5898da4DF1d45EAb2B7B192a361C3b9EB18d9c", "selector": "0x6a42b8f8", "getter": "delay()" }, "documented_delay_seconds": 86400, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-10/block-26403121-summary.md", "summary_sha256": "0x64b868f9d22c2994ecac03962ff2606d52fb7a4ad5a77ebb595911001b70db19", "base_eas_uid": "0xfdd83c8091ef6e8ffe67e8a55a78892fcfbb1092683b21ff2d85f8cc09750e6c" }, { "id": "maple-v2-syrup-ppm-admin", "protocol": "Maple Finance V2 / Syrup", "category": "Institutional Credit / RWA", "sprint": 6, "block_number": 26401540, "block_hash": "0x49324aaf84b0ffd4e21026c5345272788bff377f0f86fcdb74280cdfc32a9641", "classification": "parameter_delta", "surface": "EIP-1967 Proxy Admin Slot vs. GovernorTimelock", "target_contract": "0xBe10aDcE8B6E3E02Db384E7FaDA5395DD113D8b3", "target_label": "PoolPermissionManager", "check_type": "eth_getStorageAt", "selector_or_slot": "0xb53127684a568b3173ae13b9f8a6016e243e63b6e8ee1178d6a717850b5d6103", "onchain_observed": "EIP-1967 admin slot holds 4-of-7 Maple DAO Safe (0xd6d4Bcde6c816F17889f1Dd3000aF0261B03a196); Globals.governor() (0x804a6F5F667170F545Bf14e5DDB48C70B788390C) points to GovernorTimelock (0x2eFFf88747EB5a3FF00d4d8d0f0800E306C0426b, getMinDelay = 259200s / 3d); syrupUSDC (0x80ac24aA929eaF5013f6436cdA2a7ba190f5Cc0b) totalAssets = 898,551,580.57 units (6 dec).", "documented_reference": "Governor admin actions documentation describes GovernorTimelock (3-day delay) governance path.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": 259200, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-6/block-26401540-summary.md", "summary_sha256": "0xec0e3a3862cd528a35acc2992eccd798f8ce4bc8e7ea8c0311f56fa000df8471", "base_eas_uid": "0x749d96e1a3d214a4ab66c528ca12c84dce085fa138dc370dd0eb817d890f09fa" }, { "id": "ethena-admin-timelock-and-dev-safe", "protocol": "Ethena (USDe / sUSDe)", "category": "Synthetic Dollar / Basis Collateral", "sprint": 7, "block_number": 26401638, "block_hash": "0xe62ad2969617ad07c23bec298c3d5e197ea7c3084f7f66c90d2eb51d04c6273e", "classification": "parameter_delta", "surface": "TimelockController MinDelay & Dev Multisig Quorum", "target_contract": "0xE8Dc0Fab349EA169283C48Ccfd09d797E6DB7c94", "target_label": "EthenaTimelockController", "check_type": "eth_call", "selector_or_slot": "0xf27a0c92", "onchain_observed": "getMinDelay() = 86400s (1 day); Dev Multisig (0x3B0AAf6e6fCd4a7cEEf8c92C32DFeA9E64dC1862) getThreshold() = 5, getOwners().length = 10 (5-of-10 Gnosis Safe).", "documented_reference": "key-trust-assumptions.md lists 7-day time-locks and 7 signatures (key-addresses.md lists 5/11); Risk Committee forum topic 810 (Jul 2026) notes 1-day delay.", "observed_delay_seconds": 86400, "observed_delay_source": { "contract": "0xE8Dc0Fab349EA169283C48Ccfd09d797E6DB7c94", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 604800, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-7/block-26401638-summary.md", "summary_sha256": "0x326d36de4579d119b7cccc7ad36786933b50c2a0957082e28a73e6e6e6847f35", "base_eas_uid": "0x3e0e0e1b62de65b277b1399f9833cd70baf627e5ba69e17f1f4f76be30008779" }, { "id": "usual-money-registry-access-delay", "protocol": "Usual Money (USD0 / USD0++)", "category": "RWA Stablecoin", "sprint": 8, "block_number": 26401725, "block_hash": "0xec3820f0a9db32c01728e66f78dc1958e410269e1077fd1db53df4fbce2ad7a1", "classification": "parameter_delta", "surface": "OpenZeppelin AccessControlDefaultAdminRules Delay", "target_contract": "0x0D374775E962c3608B8F0A4b8B10567DF739bb56", "target_label": "RegistryAccess", "check_type": "eth_call", "selector_or_slot": "0xcc8463c8", "onchain_observed": "defaultAdminDelay() = 1s (0x01); pendingDefaultAdminDelay() = (0, 0); defaultAdmin() = 0x6e9d65eC80D69b1f508560Bc7aeA5003db1f7FB7 (8-of-15 Gnosis Safe).", "documented_reference": "tech.usual.money/overview/architecture/role-management states a delay of three days (259200s) before granting default admin to a new address.", "observed_delay_seconds": 1, "observed_delay_source": { "contract": "0x0D374775E962c3608B8F0A4b8B10567DF739bb56", "selector": "0xcc8463c8", "getter": "defaultAdminDelay()" }, "documented_delay_seconds": 259200, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-8/block-26401725-summary.md", "summary_sha256": "0x7f5605538db468ccb2f51a5822ea2dabf29fb36858f7ae301e36b1a57f6dd2d2", "base_eas_uid": "0xfd7ce0f2b980da6606c8cd755da45d99f9ae4826e6df1321ff52c2b0f8e6a6c2" }, { "id": "fluid-instadapp-vault-factory-auth", "protocol": "Fluid / Instadapp", "category": "Modular Lending & DEX Vaults", "sprint": 5, "block_number": 26401405, "block_hash": "0x26e155e1569d436406a52ecee31c94d8d8ef2ca4c45d82211a84c8c802be1510", "classification": "parameter_delta", "surface": "VaultFactory.isVaultAuth Migration Scope", "target_contract": "0x324c5Dc1fC42c7a4D43d92df1eBA58a54d13Bf2d", "target_label": "VaultFactory", "check_type": "eth_call", "selector_or_slot": "0xe04c8e5d", "onchain_observed": "isVaultAuth(vault, 0x4F6F977aCDD1177DCD81aB83074855EcB9C2D49e) returns true on Vault 76 (0x7FE0B032cB5982Af72498F96be3DD6566F7B7de8), Vault 110 (0xee327311D8640156E87eC33ea55FcbF2309e0ce6), Vault 111 (0x984636a30ed2B4A61FB7150CED644096349275d3), and Vault 144 (0x0e19B64F3A79FeeE12Df1b6f239929c6ab6C7ED0) per IGP-98 / IGP-126 migration configuration.", "documented_reference": "fluid-permissions-and-mutability.md describes narrow fee/reward/magnifier team multisig scope outside migration grants.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-5/block-26401405-summary.md", "summary_sha256": "0xfd13461161313f9bd5ae867e4076d5f07b787e05370bca7516dcbbc8ba8f63a2", "base_eas_uid": "0x804289d4357b0a8d5a360911ec450c13ca36c4422d1e811c4c7040ef7d2628e5" }, { "id": "metamorpho-re7-weth-guardian-parity", "protocol": "MetaMorpho (Re7 WETH vs. Re7 USDT)", "category": "Curated Lending Vaults", "sprint": 5, "block_number": 26401405, "block_hash": "0x26e155e1569d436406a52ecee31c94d8d8ef2ca4c45d82211a84c8c802be1510", "classification": "parameter_delta", "surface": "Sampled MetaMorpho Vault Guardian Configuration", "target_contract": "0x78Fc2c2eD1A4cDb5402365934aE5648aDAd094d0", "target_label": "MetaMorpho Re7 WETH", "check_type": "eth_call", "selector_or_slot": "0x452a9320", "onchain_observed": "Re7 WETH owner() = 0xE86399fE6d7007FdEcb08A2ee1434Ee677a04433 (2-of-4 Safe), timelock() = 259200s (3d), guardian() = 0x0000000000000000000000000000000000000000, pendingGuardian() = (0x0, 0); peer Re7 USDT (0x95EeF579155cd2C5510F312c8fA39208c3Be01a8) sets guardian() = 0x2F80ba89362f86a9acC71BFfE5EcF4997F52BDd4 (Aragon Guardian).", "documented_reference": "Peer Re7 curated vault architecture and Aragon guardian integration.", "observed_delay_seconds": 259200, "observed_delay_source": { "contract": "0x78Fc2c2eD1A4cDb5402365934aE5648aDAd094d0", "selector": "0xd33219b4", "getter": "timelock()" }, "documented_delay_seconds": 259200, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-5/block-26401405-summary.md", "summary_sha256": "0xfd13461161313f9bd5ae867e4076d5f07b787e05370bca7516dcbbc8ba8f63a2", "base_eas_uid": "0x804289d4357b0a8d5a360911ec450c13ca36c4422d1e811c4c7040ef7d2628e5" }, { "id": "mellow-lido-earn-curator-quorum", "protocol": "Mellow Protocol / Lido Earn", "category": "Liquid Restaking / Curated Vaults", "sprint": 4, "block_number": 26401312, "block_hash": "0x95866ea3ef8f9a0567ce000bc8075f6dc5fb0f1e80cb4e9999ae624a2f0dc109", "classification": "parameter_delta", "surface": "Curator Safe Quorum & Lazy Admin Signer Overlap", "target_contract": "0xe5abcc40196174Ae0d12153dE286F0D8E401769d", "target_label": "Mellow Curator Safe", "check_type": "eth_call", "selector_or_slot": "0xe75235b8", "onchain_observed": "getThreshold() = 3, getOwners().length = 5 (3-of-5 Gnosis Safe); DEFAULT_ADMIN_ROLE (0x00) on earnETH (0x6a37725ca7f4CE81c004c955f7280d5C704a249e) and earnUSD (0x014e6DA8F283C4aF65B2AA0f201438680A004452) held by 5-of-8 Lazy Vault Admin Safe (0x0Dd73341d6158a72b4D224541f1094188f57076E, Timelock 0x363Ba8843d06BA5968f55C26aB055162eDd62189 getMinDelay = 0s), where all 5 Curator signers are Lazy Vault Admin owners.", "documented_reference": "lidofinance/docs (earn/deployment-contracts.md line 199) lists 3/6 multisig; Mellow Core Vault docs describe bounded curator permissions.", "observed_delay_seconds": 0, "observed_delay_source": { "contract": "0x363Ba8843d06BA5968f55C26aB055162eDd62189", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-4/block-26401312-summary.md", "summary_sha256": "0x6adc370fdb6acbc14f38ab1b30cb90a0c1e5ce8c2457ad64177c82f548edc2fb", "base_eas_uid": "0xa26f81b0e68248c7f286527286b3d2e6b299502d53f4dfbc4397df7d22262986" }, { "id": "renzo-ezeth-deposit-queue-fee", "protocol": "Renzo Protocol (ezETH)", "category": "Liquid Restaking", "sprint": 8, "block_number": 26401725, "block_hash": "0xec3820f0a9db32c01728e66f78dc1958e410269e1077fd1db53df4fbce2ad7a1", "classification": "parameter_delta", "surface": "DepositQueue.feeBasisPoints Parameter vs. Staking Docs", "target_contract": "0xf2F305D14DCD8aaef887E0428B3c9534795D0d60", "target_label": "DepositQueue", "check_type": "eth_call", "selector_or_slot": "0xb8606eef", "onchain_observed": "feeBasisPoints() = 1500 (15%); Admin Multisig (0xD1e6626310fD54Eceb5b9a51dA2eC329D6D4B68A) is 3-of-5 Gnosis Safe; ezETH (0xbf5495Efe5DB9ce00f80364C8B423567e58d2110) totalSupply = 39,495.32 ezETH.", "documented_reference": "docs.renzoprotocol.com/docs/products/staking-suite/ezeth states 10% fee on restaking rewards.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-8/block-26401725-summary.md", "summary_sha256": "0x7f5605538db468ccb2f51a5822ea2dabf29fb36858f7ae301e36b1a57f6dd2d2", "base_eas_uid": "0xfd7ce0f2b980da6606c8cd755da45d99f9ae4826e6df1321ff52c2b0f8e6a6c2" }, { "id": "fx-protocol-v2-treasury-admin", "protocol": "f(x) Protocol v2", "category": "Leveraged ETH / Stablecoin", "sprint": 2, "block_number": 26400152, "block_hash": "0xa9a61622304ec55c5fec49abbcabec60069f66f28792cf841bdd7aef12ce63aa", "classification": "parameter_delta", "surface": "ProtocolTreasury DEFAULT_ADMIN_ROLE Holders", "target_contract": "0x32356FE312Eba9B7D6A157ad28D1ca91b571CdA6", "target_label": "ProtocolTreasury (wstETH)", "check_type": "eth_call", "selector_or_slot": "0x91d14854", "onchain_observed": "DEFAULT_ADMIN_ROLE (0x00) on all 4 v2 ProtocolTreasury proxies (0x32356FE312Eba9B7D6A157ad28D1ca91b571CdA6, 0xb178197E88D58Da21bE22A408E850d1e6Dc09A38, 0x6D9e81c5b7C4b37d0Fe9E8CDA776e057f4040868, 0x87d5e4cAaF4358A4337C10859c7107c7AEF4f8Ce) held directly by OpsSafe (0x26B2ec4E02ebe2F54583af25b647b1D619e67BbF, 6-of-9 Safe) and EmergencySafe (0x28c921adAC4c1072658eB01a28DA06b5F651eF62, 3-of-4 Safe), while Timelock (0x68863fb8855b04509a835082478D6E3D0bE4E61a, getMinDelay = 259200s) holds false.", "documented_reference": "LongPoolManager (0x250893CA4Ba5d05626C785e8da758026928FCD24) and v2 governance docs scope EmergencySafe strictly to EMERGENCY_ROLE behind 3-day Timelock admin.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": 259200, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-2/block-26400152-summary.md", "summary_sha256": "0x9c2a186cf21dd97faf2a6afb9f810e1b9f6c8503dc5f7153435c0fa48811c966", "base_eas_uid": "0xca4b525bf5142d8e88433cbed2a1aa87bb06a97d1353cb77621ec41a51ce8101" }, { "id": "inverse-finance-firm-policy-safe", "protocol": "Inverse Finance (FiRM)", "category": "Fixed-Rate Lending", "sprint": 1, "block_number": 26399876, "block_hash": "0x8bf896b892683ff3267b88b367ab015a70cf5caf53542eb405f4f648f6bcde8a", "classification": "parameter_delta", "surface": "Policy Committee Safe Quorum & GovernorMills Timelock", "target_contract": "0x4b6c63E6a94ef26E2dF60b89372db2d8e211F1B7", "target_label": "Policy Committee Safe", "check_type": "eth_call", "selector_or_slot": "0xe75235b8", "onchain_observed": "GovernorMills (0xBeCCB6bb0aa4ab551966A7E4B97cec74bb359Bf6) guardian() wrapper (0x941c2699eC7E55a50Bde030d8E1e70649839259D) references Policy Committee Safe (0x4b6c63E6a94ef26E2dF60b89372db2d8e211F1B7) with getThreshold() = 4, getOwners().length = 7 (4-of-7 Gnosis Safe); GovernorMills.timelock() (0x926dF14a23BE491164dCF93f4c468A50ef659D5B) delay() = 172800s (48h).", "documented_reference": "Working-groups governance documentation lists 5-of-9 Policy Committee multisig.", "observed_delay_seconds": 172800, "observed_delay_source": { "contract": "0x926dF14a23BE491164dCF93f4c468A50ef659D5B", "selector": "0x6a42b8f8", "getter": "delay()" }, "documented_delay_seconds": 172800, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-1/block-26399876-summary.md", "summary_sha256": "0xeb97180d687f9f8fb9a1ae341349bd74d3bc7ff95da0e4eb586e6ba4f540cffe", "base_eas_uid": "0x34049a2c64fe3355f8e325481234754c8422a48bb4784fed1d028fa40eb93058" }, { "id": "mantle-lsp-meth-upgrade-timelock", "protocol": "Mantle Liquid Staking (mETH / cmETH)", "category": "Liquid Staking & Restaking", "sprint": 10, "block_number": 26403121, "block_hash": "0x71acee2313a2c8eacd7d2c87667dc505310b3e9224d84eaebb71d5a890ef9d1c", "classification": "protective_delta", "surface": "Core Proxy EIP-1967 Admin Slot & 3-Day UpgradeTimelock", "target_contract": "0xc26016f1166bE7b6c5611AAB104122E0f6c2aCE2", "target_label": "Mantle UpgradeTimelock", "check_type": "eth_call", "selector_or_slot": "0xf27a0c92", "onchain_observed": "mETH (0xd5F7838F5C461fefF7FE49ea5ebaF7728bB0ADfa) & Staking (0xe3cBd06D7dadB3F4e6557bAb7EdD924CD1489E8f) EIP-1967 admin slots point to UpgradeTimelock (0xc26016f1166bE7b6c5611AAB104122E0f6c2aCE2) with getMinDelay() = 259200s (3 days) and PROPOSER_ROLE held by 6-of-14 Security Council Safe (0x4e59e778a0fb77fBb305637435C62FaeD9aED40f); mETH totalSupply = 217,256.94 mETH.", "documented_reference": "docs.mantle.xyz/meth/concepts/risk-management/upgradability-and-timelock.md previously noted 'The timelock is configured with a default delay of 0' (live deployment enforces stricter 3-day UpgradeTimelock).", "observed_delay_seconds": 259200, "observed_delay_source": { "contract": "0xc26016f1166bE7b6c5611AAB104122E0f6c2aCE2", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 0, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-10/block-26403121-summary.md", "summary_sha256": "0x64b868f9d22c2994ecac03962ff2606d52fb7a4ad5a77ebb595911001b70db19", "base_eas_uid": "0xfdd83c8091ef6e8ffe67e8a55a78892fcfbb1092683b21ff2d85f8cc09750e6c" }, { "id": "yearn-v3-role-manager-timelock", "protocol": "Yearn V3", "category": "Yield Aggregation Vaults", "sprint": 8, "block_number": 26401725, "block_hash": "0xec3820f0a9db32c01728e66f78dc1958e410269e1077fd1db53df4fbce2ad7a1", "classification": "protective_delta", "surface": "Sampled RoleManager.governance() Timelock Wiring", "target_contract": "0xb3bd6B2E61753C311EFbCF0111f75D29706D9a41", "target_label": "RoleManager", "check_type": "eth_call", "selector_or_slot": "0x5aa6e675", "onchain_observed": "governance() = 0x88Ba032be87d5EF1fbE87336B7090767F367BF73 (TimelockController, getMinDelay() = 604800s / 7 days); getDaddy() = 0xFEB4acf3df3cDEA7399794D0869ef76A6EfAff52 (6-of-9 ychad.eth Safe); getBrain() = 0x16388463d60FFE0661Cf7F1f31a7D658aC790ff7 (3-of-6 Safe).", "documented_reference": "yearn-devdocs security overview previously noted governance was not behind a timelock (live deployment enforces stricter 7-day TimelockController).", "observed_delay_seconds": 604800, "observed_delay_source": { "contract": "0x88Ba032be87d5EF1fbE87336B7090767F367BF73", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 0, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-8/block-26401725-summary.md", "summary_sha256": "0x7f5605538db468ccb2f51a5822ea2dabf29fb36858f7ae301e36b1a57f6dd2d2", "base_eas_uid": "0xfd7ce0f2b980da6606c8cd755da45d99f9ae4826e6df1321ff52c2b0f8e6a6c2" }, { "id": "etherfi-core-timelocks", "protocol": "ether.fi Core (eETH / weETH)", "category": "Liquid Staking & Restaking", "sprint": 7, "block_number": 26401638, "block_hash": "0xe62ad2969617ad07c23bec298c3d5e197ea7c3084f7f66c90d2eb51d04c6273e", "classification": "aligned_baseline", "surface": "Sampled Upgrade & Operating Timelock Delays", "target_contract": "0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761", "target_label": "ether.fi Upgrade Timelock", "check_type": "eth_call", "selector_or_slot": "0xf27a0c92", "onchain_observed": "Upgrade Timelock getMinDelay() = 864000s (10 days); Operating Timelock (0xcD425f44758a08BaAB3C4908f3e3dE5776e45d7a) getMinDelay() = 172800s (2 days); LiquidityPool (0x308861A430be4cce5502d0A12724771Fc6DaF216) getTotalPooledEther = 2,276,605.53 ETH.", "documented_reference": "Sampled Upgrade (10d) and Operating (2d) TimelockController delays verified at block 26401638.", "observed_delay_seconds": 864000, "observed_delay_source": { "contract": "0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 864000, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-7/block-26401638-summary.md", "summary_sha256": "0x326d36de4579d119b7cccc7ad36786933b50c2a0957082e28a73e6e6e6847f35", "base_eas_uid": "0x3e0e0e1b62de65b277b1399f9833cd70baf627e5ba69e17f1f4f76be30008779" }, { "id": "etherfi-liquid-veda-roles-authority", "protocol": "ether.fi Liquid / Veda BoringVault", "category": "Curated Restaking Vaults", "sprint": 3, "block_number": 26401070, "block_hash": "0xcf55f6a42ae610c1f8766b5c2fb676d91f178469fa10ef777eccbb76f6506234", "classification": "aligned_baseline", "surface": "Sampled RolesAuthority Owner & Timelock Wiring", "target_contract": "0x485Bde66Bb668a51f2372E34e45B1c6226798122", "target_label": "Liquid RolesAuthority", "check_type": "eth_call", "selector_or_slot": "0x8da5cb5b", "onchain_observed": "AccountantWithRateProviders (0x0d05D94a5F1E76C18fbeB7A13d17C8a314088198) authority() = 0x485Bde66Bb668a51f2372E34e45B1c6226798122; RolesAuthority.owner() = 0xD829F278016b90FEc735F9A12Bf8b75E06102C89 (TimelockController, getMinDelay = 86400s / 1d at block 26401070).", "documented_reference": "Sampled BoringVault Accountant authority() and RolesAuthority TimelockController ownership verified at block 26401070.", "observed_delay_seconds": 86400, "observed_delay_source": { "contract": "0xD829F278016b90FEc735F9A12Bf8b75E06102C89", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 86400, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-3/block-26401070-summary.md", "summary_sha256": "0x02d6de1d05599e44d0634541a13d05764a90d6f860c8d8bcfde4b0e980d3c122", "base_eas_uid": "0x291e513f3d697eea41b20bd57bf53acdb085b5566e499dd655ff46d7cd9d95a8" }, { "id": "liquity-v2-bold-immutability", "protocol": "Liquity V2 (BOLD)", "category": "Immutable CDP Stablecoin", "sprint": 6, "block_number": 26401540, "block_hash": "0x49324aaf84b0ffd4e21026c5345272788bff377f0f86fcdb74280cdfc32a9641", "classification": "aligned_baseline", "surface": "Sampled Owner & EIP-1967 Slot Alignment", "target_contract": "0x6440f144b7e50D6a8439336510312d2F54beB01D", "target_label": "BOLD Token", "check_type": "eth_call", "selector_or_slot": "0x8da5cb5b", "onchain_observed": "BOLD.owner() = 0x0; Governance (0x807DEf5E7d057DF05C796F4bc75C3Fe82Bd6EeE1) owner() = 0x0; CollateralRegistry (0xf949982B91C8c61e952B3bA942cbbfaef5386684) EIP-1967 implementation slot = 0x00...00.", "documented_reference": "Liquity V2 immutability and non-upgradeable core specification.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-6/block-26401540-summary.md", "summary_sha256": "0xec0e3a3862cd528a35acc2992eccd798f8ce4bc8e7ea8c0311f56fa000df8471", "base_eas_uid": "0x749d96e1a3d214a4ab66c528ca12c84dce085fa138dc370dd0eb817d890f09fa" }, { "id": "spark-sky-gsm-pause-delay", "protocol": "Spark / Sky", "category": "Decentralized Credit & Liquidity", "sprint": 7, "block_number": 26401638, "block_hash": "0xe62ad2969617ad07c23bec298c3d5e197ea7c3084f7f66c90d2eb51d04c6273e", "classification": "aligned_baseline", "surface": "Sampled PoolAddressesProvider Owner & GSM Delay", "target_contract": "0xbE286431454714F511008713973d3B053A2d38f3", "target_label": "GSM_PAUSE_PROXY", "check_type": "eth_call", "selector_or_slot": "0x6a42b8f8", "onchain_observed": "GSM_PAUSE_PROXY.delay() = 172800s (48 hours); Spark PoolAddressesProvider (0x02C3eA4e34C0cBd694D2adFa2c690EECbC1793eE) owner() = 0x3300f198988e4C9C63F75dF86De36421f06af8c4 (SPARK_PROXY).", "documented_reference": "Sky 48-hour Governance Security Module (GSM) delay and Spark SubDAO proxy ownership.", "observed_delay_seconds": 172800, "observed_delay_source": { "contract": "0xbE286431454714F511008713973d3B053A2d38f3", "selector": "0x6a42b8f8", "getter": "delay()" }, "documented_delay_seconds": 172800, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-7/block-26401638-summary.md", "summary_sha256": "0x326d36de4579d119b7cccc7ad36786933b50c2a0957082e28a73e6e6e6847f35", "base_eas_uid": "0x3e0e0e1b62de65b277b1399f9833cd70baf627e5ba69e17f1f4f76be30008779" }, { "id": "morpho-blue-singleton-owner", "protocol": "Morpho Blue Core", "category": "Base Lending Infrastructure", "sprint": 3, "block_number": 26401070, "block_hash": "0xcf55f6a42ae610c1f8766b5c2fb676d91f178469fa10ef777eccbb76f6506234", "classification": "aligned_baseline", "surface": "Sampled Singleton Owner & Fee/LLTV Bounds", "target_contract": "0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb", "target_label": "Morpho Blue Singleton", "check_type": "eth_call", "selector_or_slot": "0x8da5cb5b", "onchain_observed": "Morpho Blue owner() = 0xcBa28b38103307Ec8dA98377ffF9816C164f9AFa and sampled fee/LLTV bounds match documentation at block 26401070.", "documented_reference": "Morpho Blue core singleton ownership and immutable fee/LLTV bound specification.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-3/block-26401070-summary.md", "summary_sha256": "0x02d6de1d05599e44d0634541a13d05764a90d6f860c8d8bcfde4b0e980d3c122", "base_eas_uid": "0x291e513f3d697eea41b20bd57bf53acdb085b5566e499dd655ff46d7cd9d95a8" }, { "id": "convex-booster-governance-chain", "protocol": "Convex Finance", "category": "Curve Governance Aggregation", "sprint": 4, "block_number": 26401312, "block_hash": "0x95866ea3ef8f9a0567ce000bc8075f6dc5fb0f1e80cb4e9999ae624a2f0dc109", "classification": "aligned_baseline", "surface": "Sampled Booster Governance Ownership Chain", "target_contract": "0xF403C135812408BFbE8713b5A23a04b3D48AAE31", "target_label": "Convex Booster", "check_type": "eth_call", "selector_or_slot": "0x8da5cb5b", "onchain_observed": "Convex Booster (0xF403C135812408BFbE8713b5A23a04b3D48AAE31) owner() resolves via 0x3cE6408F923326f81A7D7929952947748180f1E6 -> 0x256e1bbA846611C37CF89844a02435E6C098b86D -> 3-of-5 DAO Multisig (0xa3C5A1e09150B75ff251c1a7815A07182c3de2FB) at block 26401312.", "documented_reference": "Convex Booster governance ownership hierarchy documentation.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-4/block-26401312-summary.md", "summary_sha256": "0x6adc370fdb6acbc14f38ab1b30cb90a0c1e5ce8c2457ad64177c82f548edc2fb", "base_eas_uid": "0xa26f81b0e68248c7f286527286b3d2e6b299502d53f4dfbc4397df7d22262986" }, { "id": "compound-v3-comet-timelock-and-pause-safe", "protocol": "Compound V3 (Comet)", "category": "Blue-Chip Lending", "sprint": 9, "block_number": 26402160, "block_hash": "0xd04a5e8aa3500c5b60d90c25a810ef28eb9d1bfffadf28f1da58a31ed90582dc", "classification": "aligned_baseline", "surface": "Comet Governor, 48h Timelock & Pause-Guardian Safe", "target_contract": "0xc3d688B66703497DAA19211EEdff47f25384cdc3", "target_label": "cUSDCv3", "check_type": "eth_call", "selector_or_slot": "0x0c340a24", "onchain_observed": "Sampled cUSDCv3 (0xc3d688B66703497DAA19211EEdff47f25384cdc3) & cWETHv3 (0xA17581A9E3356d9A858b789D68B4d866e593aE94) governor() = CompoundTimelock (0x6d903f6003cca6255D85CcA4D3B5E5146dC33925, delay() = 172800s / 48h, admin() = CompoundGovernor 0x309a862bbC1A00e45506cB8A802D1ff10004c8C0); pauseGuardian() = 5-of-9 Community Pause Safe (0xbbf3f1421D886E9b2c5D716B5192aC998af2012c).", "documented_reference": "Compound V3 governance documentation specifies 48-hour Timelock ownership and Community Multi-Sig pause guardian.", "observed_delay_seconds": 172800, "observed_delay_source": { "contract": "0x6d903f6003cca6255D85CcA4D3B5E5146dC33925", "selector": "0x6a42b8f8", "getter": "delay()" }, "documented_delay_seconds": 172800, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-9/block-26402160-summary.md", "summary_sha256": "0x0a4b9cbd0c3f3eb1839a86753857a603237918200e1d9f90e757f70008472ef4", "base_eas_uid": "0x0e017bc4399101f9fef3d98a434dd9f2829b6e386e7733408dfd4b626d186eea" }, { "id": "aave-v3-gho-acl-manager-and-executor-lvl1", "protocol": "Aave V3 / GHO", "category": "Blue-Chip Lending & Decentralized Stablecoin", "sprint": 9, "block_number": 26402160, "block_hash": "0xd04a5e8aa3500c5b60d90c25a810ef28eb9d1bfffadf28f1da58a31ed90582dc", "classification": "aligned_baseline", "surface": "ACLManager Admin Role, Executor Lvl1 Delay & Guardian Safe", "target_contract": "0xc2aaCf6553D20d1e9d78E365AAba8032af9c85b0", "target_label": "ACLManager", "check_type": "eth_call", "selector_or_slot": "0x91d14854", "onchain_observed": "ACLManager hasRole(DEFAULT_ADMIN_ROLE, 0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A) = true; PayloadsController (0xdAbad81aF85554E9ae636395611C58F7eC1aAEc5) getExecutorSettingsByAccessControl(1) = (0x5300A1a15135EA4dc7aD5a167152C01EFc9b192A, 86400s / 1d); EMERGENCY_ADMIN held by 4-of-7 Protocol Guardian Safe (0x2CFe3ec4d5a6811f4B8067F0DE7e47DfA938Aa30); GHO (0x40D16FC0246aD3160Ccc09B8D0D3A2cD28aE6C2f) totalSupply = 699,000,000 GHO.", "documented_reference": "Aave V3 & Governance v3 address book specifies Level 1 Short Executor (1-day execution delay) and 4-of-7 Protocol Guardian Safe.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": 86400, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-9/block-26402160-summary.md", "summary_sha256": "0x0a4b9cbd0c3f3eb1839a86753857a603237918200e1d9f90e757f70008472ef4", "base_eas_uid": "0x0e017bc4399101f9fef3d98a434dd9f2829b6e386e7733408dfd4b626d186eea" }, { "id": "kelp-dao-rseth-proxy-admin-and-timelock", "protocol": "Kelp DAO (rsETH)", "category": "Liquid Restaking", "sprint": 9, "block_number": 26402160, "block_hash": "0xd04a5e8aa3500c5b60d90c25a810ef28eb9d1bfffadf28f1da58a31ed90582dc", "classification": "aligned_baseline", "surface": "ProxyAdmin 10d Timelock & LRTConfig Admin Safe", "target_contract": "0x49bD9989E31aD35B0A62c20BE86335196A3135B1", "target_label": "KelpTimelockController", "check_type": "eth_call", "selector_or_slot": "0xf27a0c92", "onchain_observed": "rsETH (0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7) EIP-1967 admin slot = ProxyAdmin (0xb61e0E39b6d4030C36A176f576aaBE44BF59Dc78), owner() = TimelockController (0x49bD9989E31aD35B0A62c20BE86335196A3135B1, getMinDelay() = 864000s / 10d); LRTConfig (0x947Cb49334e6571ccBFEF1f1f1178d8469D65ec7) DEFAULT_ADMIN_ROLE held by 6-of-11 Safe (0xb3696a817D01C8623E66D156B6798291fa10a46d); rsETH totalSupply = 338,071.33 rsETH.", "documented_reference": "Kelp DAO security & contract documentation specifies 10-day TimelockController upgrade governance and multisig admin.", "observed_delay_seconds": 864000, "observed_delay_source": { "contract": "0x49bD9989E31aD35B0A62c20BE86335196A3135B1", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 864000, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-9/block-26402160-summary.md", "summary_sha256": "0x0a4b9cbd0c3f3eb1839a86753857a603237918200e1d9f90e757f70008472ef4", "base_eas_uid": "0x0e017bc4399101f9fef3d98a434dd9f2829b6e386e7733408dfd4b626d186eea" }, { "id": "eigenlayer-core-proxy-admin-and-timelock", "protocol": "EigenLayer Core", "category": "Restaking Infrastructure", "sprint": 9, "block_number": 26402160, "block_hash": "0xd04a5e8aa3500c5b60d90c25a810ef28eb9d1bfffadf28f1da58a31ed90582dc", "classification": "aligned_baseline", "surface": "Core ProxyAdmin, Dual-Owner Executor Safe & 10d Timelock", "target_contract": "0xC06Fd4F821eaC1fF1ae8067b36342899b57BAa2d", "target_label": "EigenLayerTimelockController", "check_type": "eth_call", "selector_or_slot": "0xf27a0c92", "onchain_observed": "DelegationManager (0x39053D51B77DC0d36036Fc1fCc8Cb819df8Ef37A) EIP-1967 admin slot = Core ProxyAdmin (0x8b9566AdA63B64d1E1dcF1418b43fd1433b72444), owner() = 1-of-2 ExecutorMultisig (0x369e6F597e22EaB55fFb173C6d9cD234BD699111) shared between 10d TimelockController (0xC06Fd4F821eaC1fF1ae8067b36342899b57BAa2d, getMinDelay() = 864000s) and 9-of-13 CommunityMultisig (0xFEA47018D632A77bA579846c840d5706705Dc598); pauserRegistry() = 0xB8765ed72235d279c3Fb53936E4606db0Ef12806.", "documented_reference": "Layr-Labs/eigenlayer-contracts main README documents Core ProxyAdmin, 10-day TimelockController + CommunityMultisig Executor wrapper, and PauserRegistry 0xB8765ed72235d279c3Fb53936E4606db0Ef12806.", "observed_delay_seconds": 864000, "observed_delay_source": { "contract": "0xC06Fd4F821eaC1fF1ae8067b36342899b57BAa2d", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 864000, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-9/block-26402160-summary.md", "summary_sha256": "0x0a4b9cbd0c3f3eb1839a86753857a603237918200e1d9f90e757f70008472ef4", "base_eas_uid": "0x0e017bc4399101f9fef3d98a434dd9f2829b6e386e7733408dfd4b626d186eea" }, { "id": "symbiotic-core-immutable-registries-and-safes", "protocol": "Symbiotic Core", "category": "Restaking Infrastructure", "sprint": 10, "block_number": 26403121, "block_hash": "0x71acee2313a2c8eacd7d2c87667dc505310b3e9224d84eaebb71d5a890ef9d1c", "classification": "aligned_baseline", "surface": "Sampled Non-Upgradeable Core Registries & Factory/Adapter Safes", "target_contract": "0xAEb6bdd95c502390db8f52c8909F703E9Af6a346", "target_label": "Symbiotic VaultFactory", "check_type": "eth_getStorageAt", "selector_or_slot": "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc", "onchain_observed": "VaultFactory (0xAEb6bdd95c502390db8f52c8909F703E9Af6a346), OperatorRegistry (0xAd817a6Bc954F678451A71363f04150FDD81Af9F), and NetworkRegistry (0xC773b1011461e7314CF05f97d95aa8e92C1Fd8aA) hold zero EIP-1967 implementation/admin slots (0x00...00); VaultFactory.owner() = 2-of-3 Gnosis Safe (0x5721ce64Ee0D772Ce613b62D411350091C544cD0); AdapterRegistry (0x788823C9579A049D986eB76718bC758C0998594a) owner() = 3-of-5 Gnosis Safe (0xf6BB2e64Bd201A862f2Fe5461fc7Ef01e2040b6A).", "documented_reference": "Symbiotic Core architecture specifies non-upgradeable core registries and multisig-governed implementation/adapter whitelists.", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-10/block-26403121-summary.md", "summary_sha256": "0x64b868f9d22c2994ecac03962ff2606d52fb7a4ad5a77ebb595911001b70db19", "base_eas_uid": "0xfdd83c8091ef6e8ffe67e8a55a78892fcfbb1092683b21ff2d85f8cc09750e6c" }, { "id": "lido-dual-governance-emergency-timelock", "protocol": "Lido (stETH / Dual Governance)", "category": "Blue-Chip Liquid Staking", "sprint": 10, "block_number": 26403121, "block_hash": "0x71acee2313a2c8eacd7d2c87667dc505310b3e9224d84eaebb71d5a890ef9d1c", "classification": "aligned_baseline", "surface": "EmergencyProtectedTimelock Delays, DualGovernance & Committee Safes", "target_contract": "0xCE0425301C85c5Ea2A0873A2dEe44d78E02D2316", "target_label": "EmergencyProtectedTimelock", "check_type": "eth_call", "selector_or_slot": "0x709105d7", "onchain_observed": "EmergencyProtectedTimelock (0xCE0425301C85c5Ea2A0873A2dEe44d78E02D2316) getAfterSubmitDelay() = 259200s (3d), getAfterScheduleDelay() = 86400s (1d), getGovernance() = DualGovernance (0xC1db28B3301331277e307FDCfF8DE28242A4486E), getEmergencyProtectionDetails() = (2592000, 0, 1813449600); Emergency Activation (0x8B7854488Fde088d686Ea672B6ba1A5242515f45, 4-of-7 Safe), Emergency Execution (0xC7792b3F2B399bB0EdF53fECDceCeB97FBEB18AF, 5-of-7 Safe), Reseal (0xFFe21561251c49AdccFad065C94Fb4931dF49081, 5-of-6 Safe), and CircuitBreaker (0x8772E3a2D86B9347A2688f9bc1808A6d8917760C, 3-of-6 Safe); stETH totalSupply = 9,759,371.53 stETH.", "documented_reference": "lidofinance/dual-governance deploy-config-mainnet.toml, lidofinance/docs committee specs, and forum record 10032.", "observed_delay_seconds": 259200, "observed_delay_source": { "contract": "0xCE0425301C85c5Ea2A0873A2dEe44d78E02D2316", "selector": "0x709105d7", "getter": "getAfterSubmitDelay()" }, "documented_delay_seconds": 259200, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-10/block-26403121-summary.md", "summary_sha256": "0x64b868f9d22c2994ecac03962ff2606d52fb7a4ad5a77ebb595911001b70db19", "base_eas_uid": "0xfdd83c8091ef6e8ffe67e8a55a78892fcfbb1092683b21ff2d85f8cc09750e6c" }, { "id": "lombard-lbtc-core-proxy-upgrade-timelock", "protocol": "Lombard (LBTC)", "category": "Institutional BTCfi / Liquid Staked Bitcoin", "sprint": 11, "block_number": 26403523, "block_hash": "0xfc7beaa2338e8054577c0b101b641bc42afca2af39cb85d3fc13cbee32d4681a", "classification": "aligned_baseline", "surface": "Sampled Core ProxyAdmin Wiring & 24h TimelockController", "target_contract": "0x055E84e7FE8955E2781010B866f10Ef6E1E77e59", "target_label": "Lombard TimelockController", "check_type": "eth_call", "selector_or_slot": "0xf27a0c92", "onchain_observed": "LBTC (0x8236a87084f8B84306f72007F36F2618A5634494) EIP-1967 admin slot = ProxyAdmin (0xbae061C73876952aa2C5e483B74DfA785425f879), whose owner() \u2014 along with AssetRouter ProxyAdmin (0xBf4202c8a0d852D432266dfE112ED624a1a36754) and Consortium ProxyAdmin (0x1629AE77cC70DaAc95Ec479caAEA23ECE77c67c5) \u2014 resolves to TimelockController (0x055E84e7FE8955E2781010B866f10Ef6E1E77e59, getMinDelay() = 86400s / 24h, EXECUTOR_ROLE held by 3-of-5 Safe 0x251a604E8E8f6906d60f8dedC5aAeb8CD38F4892 with Guard 0x87bde523e05Fee2C557d6F592F7EB686C69189Ab); LBTC totalSupply = 6,203.54 LBTC (8 dec).", "documented_reference": "docs.lombard.finance/learn/transparency/smart-contracts states 'Each Proxy Upgrade Timelock enforces a 24-hour minimum delay on contract upgrades.'", "observed_delay_seconds": 86400, "observed_delay_source": { "contract": "0x055E84e7FE8955E2781010B866f10Ef6E1E77e59", "selector": "0xf27a0c92", "getter": "getMinDelay()" }, "documented_delay_seconds": 86400, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-11/block-26403523-summary.md", "summary_sha256": "0xc4a599ac19a79b5e24627692ccfc0431ba231ab8bea24236b8b876b5605ebaa8", "base_eas_uid": "0x754edd7612258b755ff2e56903243d1f8867bad53c29ce3febb5ed9114005e42" }, { "id": "resolv-usr-default-admin-delay-and-safe", "protocol": "Resolv (USR / RLP)", "category": "Delta-Neutral Synthetic Dollar", "sprint": 11, "block_number": 26403523, "block_hash": "0xfc7beaa2338e8054577c0b101b641bc42afca2af39cb85d3fc13cbee32d4681a", "classification": "aligned_baseline", "surface": "Sampled USR AccessControlDefaultAdminRules Delay & Request Counters", "target_contract": "0x66a1E37c9b0eAddca17d3662D6c05F4DECf3e110", "target_label": "Resolv USR Token", "check_type": "eth_call", "selector_or_slot": "0xcc8463c8", "onchain_observed": "Sampled USR (0x66a1E37c9b0eAddca17d3662D6c05F4DECf3e110) defaultAdmin() = 4-of-6 Core Safe (0xD6889F307BE1b83Bb355d5DA7d4478FB0d2Af547) with defaultAdminDelay() = 86400s (1 day); sampled UsrExternalRequestsManager (0xa27a69Ae180e202fDe5D38189a3F24Fe24E55861) and RlpExternalRequestsManager (0xc7AB90c2Ea9271EFB31f5fA2843Eeb4B331eaFA0) return paused() = true; USR totalSupply = 6,085,929.53 USR, RLP (0x4956b52aE2fF65D74CA2d61207523288e4528f96) totalSupply = 1,592,731.62 RLP.", "documented_reference": "docs.resolv.xyz/litepaper/for-developers/smart-contracts.md core token and external request manager deployment registry.", "observed_delay_seconds": 86400, "observed_delay_source": { "contract": "0x66a1E37c9b0eAddca17d3662D6c05F4DECf3e110", "selector": "0xcc8463c8", "getter": "defaultAdminDelay()" }, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-11/block-26403523-summary.md", "summary_sha256": "0xc4a599ac19a79b5e24627692ccfc0431ba231ab8bea24236b8b876b5605ebaa8", "base_eas_uid": "0x754edd7612258b755ff2e56903243d1f8867bad53c29ce3febb5ed9114005e42" }, { "id": "stakewise-v3-oseth-oracle-quorum-and-ltv", "protocol": "StakeWise V3 (osETH)", "category": "Liquid Staking Infrastructure", "sprint": 12, "block_number": 26403676, "block_hash": "0xf4246ca23c4c38d520de16080a11b5186d04c8242b2c85edcb04c455d291c3ae", "classification": "aligned_baseline", "surface": "Sampled Keeper Oracle Quorum, osETH Fee & LTV Configuration", "target_contract": "0x6B5815467da09DaA7DC83Db21c9239d98Bb487b5", "target_label": "StakeWise V3 Keeper", "check_type": "eth_call", "selector_or_slot": "0x7386749e", "onchain_observed": "Sampled Keeper (0x6B5815467da09DaA7DC83Db21c9239d98Bb487b5) totalOracles() = 11, rewardsMinOracles() = 6, validatorsMinOracles() = 6 (6-of-11 oracle signature quorum); osETH (0xf1C9acDc66974dFB6dEcB12aA385b9cD01190E38) owner() = 0x0000000000000000000000000000000000000000, totalSupply = 148,452.02 osETH (18 dec); OsTokenVaultController (0x2A261e60FB14586B474C208b1B7AC6D0f5000306) feePercent() = 500 (5%), totalAssets = 160,753.18 ETH; OsTokenConfig (0x287d1e2A8dE183A8bf8f2b09Fa1340fBd766eb59) getConfig(0x0000000000000000000000000000000000000000) = (1.01e18, 0.92e18, 0.90e18) (90% mint LTV, 92% liquidation threshold).", "documented_reference": "docs.stakewise.io/docs/oracles/intro ('currently 6 of 11 Oracles'), docs/fees/intro ('5% fee on the rewards accumulated by osETH'), and docs/ostoken/how-ostoken-works ('liquidation threshold is set to 92% LTV').", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-12/block-26403676-summary.md", "summary_sha256": "0x66205001b915f64cb7154d4f3d8643ea60348e6460bff476ff3f1fc6e7a60b26", "base_eas_uid": "0x7caae9c22c86ae171392def07dce83fa5da6fbf904b1ba9b5ff66a5021b16de9" }, { "id": "swell-sweth-rsweth-timelock-and-reprice-bounds", "protocol": "Swell (swETH / rswETH)", "category": "Liquid Staking & Restaking", "sprint": 12, "block_number": 26403676, "block_hash": "0xf4246ca23c4c38d520de16080a11b5186d04c8242b2c85edcb04c455d291c3ae", "classification": "aligned_baseline", "surface": "Sampled 7-Day SwellTimelock, ProxyAdmins & Reprice Bounds", "target_contract": "0xbA829003e6b5dD858fbed3945719939a6DC3073b", "target_label": "SwellTimelock", "check_type": "eth_call", "selector_or_slot": "0x6a42b8f8", "onchain_observed": "swETH (0xf951E335afb289353dc249e82926178EaC7DEd78) EIP-1967 admin ProxyAdmin (0x25EAf579cA2255fAA5463c635eec28697b5b8846) and rswETH (0xFAe103DC9cf190eD75350761e95403b7b8aFa6c0) EIP-1967 admin ProxyAdmin (0xD750B84845f1cAdfEAc63f96Ec74635e949bFd14) both resolve owner() to SwellTimelock (0xbA829003e6b5dD858fbed3945719939a6DC3073b, delay() = 604800s / 7d, admin() = 4-of-7 Safe 0x20fDF47509C5eFC0e1101e3CE443691781C17F90), which is also the sole PLATFORM_ADMIN on both AccessControlManagers (0x625087d72c762254a72CB22cC2ECa40da6b95EAC, 0x796592b2092F7E150C48643dA19Dd2F28be3333F); minimumRepriceTime = 3600s (1h), maximumRepriceDifferencePercentage = 1% (1e16); swETH totalSupply = 9,635.13 swETH, rswETH totalSupply = 10,363.44 rswETH.", "documented_reference": "Swell v3-core-public deployment architecture specifying 7-day Timelock upgrade/platform-admin control, 1h minimum reprice cadence, and 1% maximum reprice bound.", "observed_delay_seconds": 604800, "observed_delay_source": { "contract": "0xbA829003e6b5dD858fbed3945719939a6DC3073b", "selector": "0x6a42b8f8", "getter": "delay()" }, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-12/block-26403676-summary.md", "summary_sha256": "0x66205001b915f64cb7154d4f3d8643ea60348e6460bff476ff3f1fc6e7a60b26", "base_eas_uid": "0x7caae9c22c86ae171392def07dce83fa5da6fbf904b1ba9b5ff66a5021b16de9" }, { "id": "superstate-ustb-uscc-fee-and-usdc-alignment", "protocol": "Superstate (USTB / USCC)", "category": "Institutional RWA / Tokenized Funds", "sprint": 12, "block_number": 26403676, "block_hash": "0xf4246ca23c4c38d520de16080a11b5186d04c8242b2c85edcb04c455d291c3ae", "classification": "aligned_baseline", "surface": "Sampled USDC Subscription Fee & Fund Supply Alignment", "target_contract": "0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e", "target_label": "Superstate USTB", "check_type": "eth_call", "selector_or_slot": "0xbf7d9119", "onchain_observed": "Sampled USTB (0x43415eB6ff9DB7E26A15b704e7A3eDCe97d31C4e) supportedStablecoins(0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48) returns sweep destination 0x774AE279c21B6a17a6E2BD5ab5398FF98F398807 and subscription fee = 0 for USDC; USTB totalSupply = 39,459,575.14 USTB (6 dec), USCC (0x14d60E7FDC0D71d8611742720E4C50E7a974020c) totalSupply = 4,066,680.13 USCC (6 dec).", "documented_reference": "docs.superstate.com/investors/smart-contracts.md states 'At time of writing, fees are set to 0 and only USDC is supported.'", "observed_delay_seconds": null, "observed_delay_source": null, "documented_delay_seconds": null, "verification_status": "scanner_dual_rpc_replayed_and_static_schema_checked", "summary_doc": "audits/sprint-12/block-26403676-summary.md", "summary_sha256": "0x66205001b915f64cb7154d4f3d8643ea60348e6460bff476ff3f1fc6e7a60b26", "base_eas_uid": "0x7caae9c22c86ae171392def07dce83fa5da6fbf904b1ba9b5ff66a5021b16de9" } ] }