Constructor args match governance proposal
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor checks whether the constructor arguments of the deployed contract match the arguments stated in any governance proposal or documentation that authorized the deployment. The assessment compares the on-chain constructor calldata from the deploy transaction against the proposal text, audit report, or governance vote that described the intended deployment parameters.
Why it matters
Silent deviations between what governance approved and what was actually deployed are a category of insider or deployment-process attack. A proposer who controls both the deployment and the proposal wording can submit a governance vote describing deployment parameters that differ from the bytecode actually deployed. Auditors typically review the described parameters against the source code; they do not independently verify that the deployed bytecode's constructor arguments match the governance proposal wording. This gap creates a window for concealed parameter changes that alter protocol behavior without triggering alarm.
Green / Yellow / Red
Green is assigned when constructor arguments in the deploy transaction are verified to match the governance proposal or documentation describing the deployment, with on-chain proof available. Yellow covers cases where a partial match is established but one or more parameters cannot be confirmed against proposal text. Red is assigned when a material discrepancy exists between deployed constructor arguments and the governance proposal, or when no proposal exists for a material parameter configuration.
Common gray cases
This factor is grayed when the protocol deployed before any governance proposal mechanism existed, or when constructor args are not human-readable without ABI decoding and the source ABI is unavailable.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether the deployed contract's constructor arguments match what the governance proposal or deploy announcement stated.