★ Immutable oracle address

Evidence summary #

[★ CRITICAL — RED] baseTokenPriceFeed declared immutable in Comet.sol. All collateral price feeds packed as immutable variables. No admin setter. Oracle replacement requires full governance cycle + new implementation deployment (5-7 days minimum). No emergency path.

Detail #

Comet.sol declares 'address public override immutable baseTokenPriceFeed'. Collateral asset feeds are stored in immutable packed variables (asset00_a, asset00_b, etc.) in the compiled implementation. No setOracle(), updateFeed(), or equivalent admin-replaceable adapter wrapper exists. Any oracle address change requires: governance proposal → 3-day vote → 2-day Timelock → CometFactory deployment of new implementation → proxy upgrade. DeFiScan explicitly states 'Oracle replacement requires a governance vote through the Configurator, which involves the full timelock delay (minimum 2 days)' and Compound docs confirm 'each time an immutable parameter is set via governance proposal, a new Comet implementation must be deployed by the Comet factory.' If a collateral asset depegs and Chainlink continues to report its pre-depeg price, the protocol has no emergency repricing path for at least 5-7 days. This is the exact RD-F-180 failure pattern.

Sources #

Methodology #

Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.

See the full factor methodology and distribution across all protocols →