delegatecall with user-controlled target

Convex Finance's assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No user-controlled delegatecall found in Convex core contracts. VoterProxy has execute() for Curve interactions but it is Booster-operator-only (not user-callable). BoosterOwner has execute() restricted to owner. ExtraRewardStashV3, ClaimZap, and BaseRewardPool have no delegatecall. Source inspection of all major contracts confirmed.

Sources #

GitHub
Convex Booster.sol source inspection (no user-controlled delegatecall)Booster.sol - no user-controlled delegatecallretrieved 2026-05-16
Etherscan
BoosterOwner source (Etherscan - execute() admin-only)BoosterOwner execute() restricted to ownerretrieved 2026-05-16

Methodology #

Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol convex-finance factor RD-F-012 score green collected_at 2026-05-16 02:41:28