Role separation: upgrade ≠ fee ≠ oracle
Convex Finance's assessment for RD-F-035 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Immutable contracts: no upgrader role. Fee management: setFeeManager on Booster callable by owner (multisig); feeManager can then call setFees, setTreasury. Pool management: poolManager is a distinct configurable address. Vote delegation: voteDelegate is a configurable address set by owner. Partial separation (poolManager distinct) exists, but feeManager is multisig-delegated and voteDelegate is controlled by same multisig owner. Not a clean three-way separation.
Sources #
- GitHubConvex Booster.sol -- GitHub sourceBooster.sol: feeManager role, poolManager role, owner role -- partial separationretrieved 2026-05-16
- Convex Finance -- Multisig Admin RightsFee ranges and treasury allocation described; multisig controls these parametersretrieved 2026-05-16
Methodology #
Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.
See the full factor methodology and distribution across all protocols →