UUPS _authorizeUpgrade correctly permissioned

Convex Finance's assessment for RD-F-021 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

All core Convex contracts (Booster, VoterProxy, CVX token, CvxLockerV2, BaseRewardPool) are non-upgradeable. Profile §3 confirms all deployments listed with proxy: false. No UUPS or transparent proxy pattern to assess. BoosterOwner is an admin controller, not a proxy implementation.

Sources #

Etherscan
Booster Etherscan (non-upgradeable confirmed, no proxy pattern)Booster - non-upgradeable, Exact Match verificationretrieved 2026-05-16
Docs
Convex Finance contract addresses (non-upgradeable confirmed)Profile §3 deployment table (all proxy: false)retrieved 2026-05-16

Methodology #

Determine whether the UUPS implementation defines `_authorizeUpgrade(address)` restricted to owner/admin/timelock (not open to arbitrary callers).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol convex-finance factor RD-F-021 score not_applicable collected_at 2026-05-16 02:41:28