Deployed bytecode matches signed release tag

Evidence summary #

No formal signed release-tag-to-deployment matching discipline found for crvUSD. GitHub repo has 3,025 commits and 1 tag. Etherscan source verification is used as the primary bytecode authenticity mechanism rather than a cryptographically-signed release tag. Marking yellow: source is public and verifiable but no formal release artifact hash discipline.

Sources #

Methodology #

Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.

See the full factor methodology and distribution across all protocols →