Role separation: upgrade ≠ fee ≠ oracle

crvUSD (Curve Stablecoin)'s assessment for RD-F-035 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Upgrade-equivalent (market admin via ControllerFactory) and oracle-config (set_monetary_policy) both map to Deployer 2 EOA. Fee routing goes to distinct fee_receiver address 0xeCb456EA5365865EbAb8a2661B0c503410e9B347. Two of three roles (admin + oracle) held by same EOA; fee role is distinct. Partial role separation.

Sources #

Etherscan
ControllerFactory fee_receiver()fee_receiver() on ControllerFactory returns 0xeCb456EA5365865EbAb8a2661B0c503410e9B347 (distinct from admin 0xbabe61887f1de2713c6f97e567623453d3c79f67)retrieved 2026-05-16
Etherscan
Controller readContractController set_monetary_policy() is admin-gated (factory admin = Deployer 2 EOA)retrieved 2026-05-16

Methodology #

Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol crvusd factor RD-F-035 score yellow collected_at 2026-05-16 19:09:40