{
 "version": "v1",
 "generatedAt": "2026-10-15T21:09:14Z",
 "name": "Arcus Perps BridgeVault",
 "named_from": "dashboard",
 "chain": "Robinhood Chain",
 "address": "0x14b107cf534239c59571b066cb6497a321da897c",
 "composite": 31,
 "band": "weak",
 "keys_to_move": null,
 "react_hours": 24,
 "money_per_key_usd": null,
 "not_assessed": [
  "how many keys it takes to move it",
  "the money behind one key (no money figure, or no key count)"
 ],
 "sub": {
  "adminKeyScore": 50,
  "multisigScore": 35,
  "timelockScore": 0,
  "oracleAuthorityScore": 100,
  "crossExposureScore": 80
 },
 "requirements": [
  {
   "label": "Admin power is not a bare key",
   "met": true
  },
  {
   "label": "At least a 3-of-5 multisig",
   "met": false
  },
  {
   "label": "A confirmed delay before changes apply, no bypass",
   "met": false
  },
  {
   "label": "Bypass paths of the delay checked and ruled out",
   "met": false
  },
  {
   "label": "Price feed not under one hand",
   "met": true
  },
  {
   "label": "No key shared with another tracked protocol",
   "met": false
  }
 ],
 "exit_window": "none: a change applies at once",
 "tvl_usd": 58015375.730413884,
 "category": "Derivatives",
 "at_risk_usd": 40030609.253985584,
 "narrative": {
  "summary": "Deposit and withdrawal custody vault for Arcus Perps. Its admin role is held by a real 24-hour timelock and, in parallel, by a validator contract whose 2-of-3 bare-EOA quorum can, per Arcus\u2019s published ABI, run arbitrary calls with only a deadline field, so the delay may not bind that path.",
  "tag": "24.2M arcUSDG held, cross-exposure 80",
  "detail": "DEFAULT_ADMIN_ROLE is held by three contracts: the timelock (getMinDelay 86,400s), ValidatorConsensus (threshold 2 of 3 validators, all bare EOAs) and CheckpointManager. The timelock\u2019s proposer, executor and canceller roles are held by ValidatorConsensus, CheckpointManager and one further address, a 2-of-4 Safe that is also one of the three owners of the Arcus pToken 2-of-3 Safe, which is why crossExposureScore is 80. Arcus publishes ABIs only, so the claim that the validator quorum can route around the delay comes from the signature of executeGovernanceAction (arbitrary calls plus a deadline, no delay field), not from source, and that function has never run (executedGovernanceCount is 0)."
 },
 "score_account": null,
 "paused": null,
 "side_roles": null,
 "side_pending": null,
 "safe_activity": null,
 "admin_probe": null,
 "held": null,
 "dispute": null,
 "independent_read_reproduce": {
  "rpc": "https://rpc.mainnet.chain.robinhood.com",
  "steps": [
   {
    "what": "getRoleMember(DEFAULT_ADMIN_ROLE, 0) on the contract (AccessControl, enumerable): the holder",
    "method": "eth_call",
    "params": [
     {
      "to": "0x14b107cf534239c59571b066cb6497a321da897c",
      "data": "0x9010d07c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
     },
     "0x55508a0"
    ]
   },
   {
    "what": "getMinDelay() on the holder (OpenZeppelin TimelockController), in seconds",
    "method": "eth_call",
    "params": [
     {
      "to": "0x0da180b14721ce46a83669b4816cb652caa1001d",
      "data": "0xf27a0c92"
     },
     "latest"
    ]
   },
   {
    "what": "the implementation slot of the proxy (EIP-1967): the code behind it, an upgrade changes this word",
    "method": "eth_getStorageAt",
    "params": [
     "0x14b107cf534239c59571b066cb6497a321da897c",
     "0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc",
     "latest"
    ]
   }
  ],
  "curl": "# getRoleMember(DEFAULT_ADMIN_ROLE, 0) on the contract (AccessControl, enumerable): the holder\ncurl -s -X POST https://rpc.mainnet.chain.robinhood.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x14b107cf534239c59571b066cb6497a321da897c\",\"data\":\"0x9010d07c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000\"},\"0x55508a0\"]}'\n# getMinDelay() on the holder (OpenZeppelin TimelockController), in seconds\ncurl -s -X POST https://rpc.mainnet.chain.robinhood.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x0da180b14721ce46a83669b4816cb652caa1001d\",\"data\":\"0xf27a0c92\"},\"latest\"]}'\n# the implementation slot of the proxy (EIP-1967): the code behind it, an upgrade changes this word\ncurl -s -X POST https://rpc.mainnet.chain.robinhood.com -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getStorageAt\",\"params\":[\"0x14b107cf534239c59571b066cb6497a321da897c\",\"0x360894a13ba1a3210667c828492db98dca3e2076cc3735a920a3ca505d382bbc\",\"latest\"]}'",
  "block": "0x55508a0",
  "note": "read between blocks 89458462 and 89458848 of the chain"
 },
 "history": [
  {
   "t": "2026-10-13T03:26:46Z",
   "composite": 31,
   "from": "push"
  }
 ],
 "feed": "https://raw.githubusercontent.com/RealSpap/authority-risk-oracle-showcase/watch-data/feed/robinhood-chain/0x14b107cf534239c59571b066cb6497a321da897c.xml",
 "reproduce": {
  "rpc": "https://rpc.testnet.chain.robinhood.com/rpc",
  "to": "0x9BF45734D09bC7CA39238e767B2af9AAc62a7f52",
  "data": "0xd47875d000000000000000000000000014b107cf534239c59571b066cb6497a321da897c",
  "block": "latest",
  "composite_word": 6,
  "block_honoured": false,
  "note": "this RPC cannot replay the block of the build (it ignores the block tag, or no longer serves old state): the call reproduces the current value, not the one of the build; compare the composite and lastUpdated with this page",
  "curl": "curl -s -X POST https://rpc.testnet.chain.robinhood.com/rpc -H 'content-type: application/json' -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"0x9BF45734D09bC7CA39238e767B2af9AAc62a7f52\",\"data\":\"0xd47875d000000000000000000000000014b107cf534239c59571b066cb6497a321da897c\"},\"latest\"]}'"
 },
 "consumer_example": {
  "verdict": "zero",
  "collateral_factor_bps": 0,
  "text": "collateral factor 0 (score 31 is under MIN_SAFE_SCORE 60)"
 },
 "cheapest_fix": {
  "band": "moderate",
  "next": 40,
  "axis": "admin key",
  "from": 50,
  "to": 73,
  "what": "a stronger admin setup (admin power spread beyond one key, or checked by others)"
 },
 "main_gap": {
  "requirement": "At least a 3-of-5 multisig",
  "reason": "Too few people need to agree"
 },
 "independent_read": {
  "path": "DEFAULT_ADMIN_ROLE member 1 of 3 (AccessControl)",
  "holder": "0x0da180b14721ce46a83669b4816cb652caa1001d",
  "pending_admin": null,
  "pending_via": null,
  "self_delay_seconds": null,
  "delay_seconds": 86400,
  "kind": "timelock",
  "since": "2026-10-10T06:54:09Z",
  "disagree": "the timelock score says no delay (0), the live read finds a timelock of 24 h in the admin path via DEFAULT_ADMIN_ROLE member 1 of 3 (AccessControl)",
  "posture": "admin: a timelock; delay: 24 h on the timelock; in flight: upgrade executed since the previous run",
  "exposure": {
   "keys_to_move": null,
   "react_hours": 24,
   "tvl_usd": 58015375.730413884,
   "money_per_key_usd": null,
   "money_source": "protocol_tvl",
   "held_symbol": null,
   "held_amount": null
  }
 },
 "score_cluster": null,
 "last_pushed": 1791862006,
 "stale": false,
 "methodology_hash": "0x667dc486af9557a83488110fdb18fe653ba6d3be4773420590ee53b4a052fa45",
 "block": 136039274,
 "live": "https://realspap.github.io/oracle/#chain=all&q=0x14b107cf534239c59571b066cb6497a321da897c",
 "page": "https://realspap.github.io/oracle/p/robinhood-0x14b107cf534239c59571b066cb6497a321da897c.html",
 "license": "CC BY 4.0, attribution: Authority Risk Oracle, realspap.github.io/oracle"
}