UUPS _authorizeUpgrade correctly permissioned

Curve Finance's assessment for RD-F-021 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Curve contracts are non-upgradeable (no UUPS, no transparent proxy, no proxy pattern at pool level). VotingEscrow.vy and all pool contracts are deployed as immutable implementations. _authorizeUpgrade is an OZ Solidity UUPS pattern not applicable to Vyper non-proxy contracts.

Sources #

URL
tricrypto-ng repository READMEtricrypto-ng README — 'cannot be killed by admin' confirms immutabilityretrieved 2026-04-28
GitHub
VotingEscrow.vy source inspectionVotingEscrow.vy — immutable, __init__ only, no proxyretrieved 2026-04-28

Methodology #

Determine whether the UUPS implementation defines `_authorizeUpgrade(address)` restricted to owner/admin/timelock (not open to arbitrary callers).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-021 score not_applicable collected_at 2026-04-28 19:48:40