Hot-patch deploys without timelock (last 30 days)
crvUSD (Curve Stablecoin)'s assessment for RD-F-138 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No hot-patch deploy mechanism exists on crvUSD core contracts. Vyper blueprints are immutable. Any code change requires deploying a new blueprint contract and passing a governance vote to activate as a new market. No bypass of the governance process for emergency patches found.
Sources #
- URLCurve Finance Core Mechanics (Zealynx Security)Curve does not use proxy contracts; no hot-patch mechanism; new implementations deploy as separate blueprintsretrieved 2026-05-16
Methodology #
Count upgrades executed in the last 30 days without going through the declared timelock path.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol crvusd factor RD-F-138 score green collected_at 2026-05-16 19:09:40