Deprecated contract paused but pause reversible by live admin

Convex Finance's assessment for RD-F-167 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

vlCVX v1 contract (0xD18140b4B819b895A3dba5442F959fA44994AF50) was deprecated March 2022. User funds were fully migrated to vlCVX v2. The v1 contract is effectively empty; admin retains owner capabilities but there is no user value to capture in the deprecated surface. The pause capability over an empty deprecated contract poses negligible risk.

Sources #

URL
Convex Finance -- vlCVX Contract Migration BlogvlCVX v1 deprecated March 2022; users migrated to v2; v1 contract now emptyretrieved 2026-05-16
Etherscan
CVX Locker v1 (deprecated) -- EtherscanCVX Locker v1 0xD18140b4B819b895A3dba5442F959fA44994AF50 -- deprecated, labeled OLDretrieved 2026-05-16

Methodology #

Determine whether a deprecated-and-paused contract's pause state is revertible by a currently-live admin role.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol convex-finance factor RD-F-167 score green collected_at 2026-05-16 02:41:28