★ Admin has mint() with unlimited max
crvUSD (Curve Stablecoin)'s assessment for RD-F-042 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
crvUSD token has mint() restricted to minter role. Minter is ControllerFactory (mints to new markets within debt ceilings). Debt ceilings set by ControllerFactory admin (Deployer 2 EOA) with no timelock. No explicit on-chain hard max supply cap on the token contract. Debt ceiling mechanism is the soft cap. EOA can increase debt ceilings and thus enable more minting immediately. Graded yellow: minting constrained by governance-set debt ceilings, but EOA can change those without timelock.
Sources #
- EtherscancrvUSD Token readContractcrvUSD token ABI shows mint(address, uint256) and set_minter(address); ControllerFactory ABI shows set_debt_ceiling(address, uint256) callable by adminretrieved 2026-05-16
- ControllerFactory debt_ceiling readControllerFactory debt_ceiling(address) read function confirms per-market ceiling mechanismretrieved 2026-05-16
Methodology #
Determine whether an admin-callable `mint` on a protocol token has no supply cap or an unlimited maximum supply.
See the full factor methodology and distribution across all protocols →