★ Flash-loanable voting weight
Convex Finance's assessment for RD-F-036 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
vlCVX (CvxLockerV2, 0x72a19342...) requires a 16-week time-lock to acquire voting weight. Contract uses epoch-based historical checkpointing: voting power is calculated from past epoch snapshots stored in the epochs[] array, not current token balance. Flash loans cannot accumulate historical locked positions within a single transaction block. Vote-escrow design prevents flash-loan governance attacks by construction.
Sources #
- EtherscanCvxLockerV2 -- EtherscanCvxLockerV2 0x72a19342e8F1838460eBFCCEf09F6585e32db86E -- verified source, 16-week lock confirmedretrieved 2026-05-16
- Convex CvxLocker.sol -- GitHub source (CvxLockerV2)CvxLocker.sol: lockDuration, checkpointEpoch(), epochs[] -- historical epoch snapshot voting; no flash-loan attack vectorretrieved 2026-05-16
Methodology #
Determine whether governance voting power is a function of current token balance of a transferable token with no lock or checkpoint, making it flash-loan susceptible.
See the full factor methodology and distribution across all protocols →