defirisk.co
rubric v1.7.0

Empty cToken-style market (zero supply/borrow)

Convex Finance's assessment for RD-F-070 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Convex Finance is NOT a Compound V2 fork and does not implement cToken-style markets. The Booster contract (0xF403C135812408BFbE8713b5A23a04b3D48AAE31, Solidity 0.6.12, non-upgradeable) routes Curve LP tokens to Curve gauges for yield optimization. No totalSupply()/totalBorrow() market primitive exists in any Convex contract. The donation/empty-market attack pattern requires a share-based lending vault with zero liquidity; Convex has no such architecture. Taxonomy Cat 4 explicitly marks this factor as Compound-fork-only and N/A for non-Compound-fork protocols. RD-F-070 is not_applicable.

Sources #

  • GitHub
    Convex Finance Platform - GitHubconvex-eth/platform repository: Booster.sol is an original yield aggregator routing Curve LP tokens to gauges; no cToken/market patternretrieved 2026-05-16
  • Etherscan
    Convex Finance Booster - EtherscanBooster 0xF403C135812408BFbE8713b5A23a04b3D48AAE31: Solidity 0.6.12, non-upgradeable; no cToken/borrow/market interface; original yield aggregator architectureretrieved 2026-05-16
  • Internal
    Taxonomy Cat 4 Compound-fork-only noteresearch/outputs/03-taxonomy.md Cat 4: Compound-fork-only (subset of lending-only): RD-F-070 -- N/A for non-Compound-fork protocolsretrieved 2026-05-16

Methodology #

Determine whether any listed Compound V2-fork market has `totalSupply == 0` and `totalBorrow == 0`, the precondition for a donation-exploit.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol convex-finance factor RD-F-070 score not_applicable collected_at 2026-05-16 02:41:28