OAK — OnChain Attack Knowledge

Worked example · 2020-20

DeFi "move fast" era timelock-free protocol upgrade cohort — EVM — 2020–2021

Loss
aggregate losses across the cohort at v0.1; no single headline loss attributable solely to timelock absence. The class is documented at the audit-finding / governance-design layer rather than the single-exploit layer. Multiple DeFi protocols deployed in 2020-2021 with upgrade authority (governance multisig, DAO executor, or proxy admin) capable of executing immediate protocol upgrades without a mandatory timelock — a governance design anti-pattern that converts any governance compromise into an immediate full-protocol extraction event.
OAK Techniques observed
OAK-T16.006 (Timelock-Free Protocol Upgrade Execution) — primary; the canonical cohort anchor for the timelock-absent governance design anti-pattern. The absent timelock is the load-bearing governance-design vulnerability: it does not cause the governance compromise but determines its blast radius. OAK-T12.002 (Governance Multisig Compromise) — secondary; when the multisig is compromised, the absence of a timelock amplifies the extraction from "detectable pending upgrade" to "immediate full-protocol drain."
Attribution
unattributed The class is a design pattern across many protocol deployments; no audit-firm finding was located to support a specific attribution to Trail of Bits or Spearbit. No single operator or protocol is solely associated with the anti-pattern.
Corrected 2026-10-11
The standalone OpenZeppelin TimelockController shipped in Contracts 3.3 on 2020-11-27 (not 2021), it is distinct from Compound's own Timelock contract, and the unsourced Compound 2020-06 date and audit-firm findings were removed.
Key teaching point
A mandatory delay between governance approval and execution (Compound's Timelock, two days in its common configuration) became a DeFi standard because timelock-free upgrade authority converts any governance-compromise event from a detectable pending threat into an immediate full-extraction event. The timelock is the load-bearing defense-in-depth primitive — it does not prevent governance capture but gives users time to observe a malicious upgrade and exit before execution.

Summary

During the "DeFi Summer" of 2020 and the protocol-launch wave that continued through 2021, many DeFi protocols deployed with upgrade authority held by a governance multisig or DAO executor that could call upgradeTo on the proxy contract in a single transaction — no mandatory delay between governance proposal approval and on-chain execution. The rationale was operational agility: teams argued that the "move fast" pace of DeFi required the ability to patch bugs and adjust parameters rapidly, and a 48-hour timelock would slow emergency response.

The structural vulnerability: if the multisig signers' keys were compromised (T11.001), the governance process was captured (T9.003 / T16.x), or a malicious insider was among the signers (T5.005), the attacker could upgrade the protocol to an attacker-controlled implementation and drain all user funds in a single block — with zero warning to users.

Compound's governance uses a Timelock contract that enforces a mandatory delay (commonly two days) between governance approval (queue) and execution (execute) [tallycompound]. OpenZeppelin released a standalone TimelockController in Contracts 3.3 on 2020-11-27, described as letting users exit a system before an admin decision takes effect [ozcontracts33]. The pattern works as follows (delay shown as 48 hours):

  1. Governance proposal passes (quorum + majority).
  2. Proposal is queued in the TimelockController with a 48-hour mandatory delay.
  3. During the 48-hour window, users and governance participants can observe the queued upgrade, inspect the proposed implementation contract, and — if the upgrade is malicious — exit their positions by withdrawing funds from the protocol.
  4. After 48 hours, the upgrade can be executed. If the upgrade was detected as malicious during the window, governance participants can coordinate a counter-proposal or users can fully exit.

The timelock does not prevent the governance compromise — it limits the blast radius by providing a user-exit window. This defense-in-depth primitive is now standard across Compound, Uniswap, Aave, and most major DeFi protocols. Protocols still deploying without a governance timelock as of 2024-2026 are considered elevated T16.006 risk.

Timeline (UTC)

When Event OAK ref
2020 (exact date not verified) Compound governance runs through a Timelock with a multi-day delay (canonical positive example)
2020–2021 Multiple DeFi protocols deploy without governance timelocks; upgrade authority held by instant-execution multisig T16.006 (anti-pattern proliferation)
2020-11-27 OpenZeppelin Contracts 3.3 adds TimelockController [ozcontracts33] (mitigation standardisation)
2024–2026 Most major DeFi protocols have adopted governance timelocks; T16.006 risk persists in long-tail protocols and new deployments that omit timelocks for operational agility T16.006 (ongoing surface)

Realised extraction

Aggregate extraction attributable solely to timelock absence is difficult to isolate from the governance-compromise event itself. The class is documented at the governance-design layer: the timelock is not the compromise surface but the blast-radius determinant.

Public references

Techniques demonstrated (2)