★ Immutable oracle address
BENQI's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL-CANDIDATE — PD-017 tracking; promoted to ★ by T-14 2026-04-22] BenqiChainlinkOracle stores feed addresses as mutable state variables in a `mapping(bytes32 => address)`, updateable via `setFeed(string symbol, address feed)` by the current oracle admin — feed addresses are NOT immutable. The entire oracle contract address is replaceable on the Comptroller via Compound V2's `_setPriceOracle(address)` admin function. Oracle IS replaceable (not red), but no confirmed timelock protects oracle replacement — a compromised oracle admin can redirect all core lending prices in a single transaction without delay. Yellow (not red): the oracle address is admin-replaceable; the risk is the absence of a timelock guard rather than true immutability. Governance-admin-analyst must confirm whether a timelock covers the oracle admin path.
Sources #
- URLCompound V2 Comptroller DocumentationCompound V2 Comptroller — _setPriceOracle admin functionretrieved 2026-05-16
- Compound V2 Comptroller.sol sourceCompound V2 Comptroller.sol source — _setPriceOracle function at compound-finance/compound-protocolretrieved 2026-05-16
- BenqiChainlinkOracle SnowtraceSnowtrace BenqiChainlinkOracle tx history — Set Admin and Set Feed transactions visibleretrieved 2026-05-16
- BenqiChainlinkOracle verified source (Snowscan)BenqiChainlinkOracle 0x316aE55EC59e0bEb2121C0e41d4BDef8bF66b32B — setFeed() and setAdmin() functions confirmed in ABI and sourceretrieved 2026-05-16
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →