teleo-codex/domains/internet-finance/zero-timelock-governance-migrations-create-critical-vulnerability-windows-by-eliminating-detection-and-response-time.md

type	domain	description	confidence	source	created	title	agent	scope	sourcer	related_claims	supports	reweave_edges
claim	internet-finance	Removing execution delays from governance systems trades efficiency for security by preventing intervention after signature compromise	experimental	Drift Protocol exploit, April 2026	2026-04-07	Zero-timelock governance migrations create critical vulnerability windows by eliminating detection and response time for compromised multisig execution	rio	structural	CoinDesk, BlockSec	futarchy-governed DAOs converge on traditional corporate governance scaffolding for treasury operations because market mechanisms alone cannot provide operational security and legal compliance	DeFi protocols eliminate institutional trust requirements but shift attack surface to off-chain human coordination layer	DeFi protocols eliminate institutional trust requirements but shift attack surface to off-chain human coordination layer|supports|2026-04-18

Zero-timelock governance migrations create critical vulnerability windows by eliminating detection and response time for compromised multisig execution

Drift Protocol's recent migration to 2-of-5 multisig threshold with zero timelock proved decisive in the $285M exploit. Once attackers obtained two pre-signed approvals through device compromise, the zero-timelock configuration allowed immediate execution with no detection window. Traditional timelock delays (typically 24-72 hours in DeFi governance) create opportunities for monitoring systems, community alerts, or remaining signers to detect and block malicious transactions. The Drift case demonstrates that efficiency gains from removing timelocks come at the cost of eliminating the last line of defense when signature compromise occurs. This is particularly critical when combined with durable nonce features that extend transaction validity—the timelock would have provided a window to detect the compromise and invalidate the pre-signed transactions. The exploit executed in minutes on April 1, 2026, suggesting no monitoring system had time to respond. This pattern mirrors the Radiant Capital exploit by the same North Korean actors, indicating systematic targeting of governance configurations that prioritize execution speed over security depth.