★ Immutable oracle address
Curve Finance's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL-CANDIDATE — F180 PD-017 flag for T-14 post-launch promotion assessment] StableSwap-NG pools declare rate_oracles: immutable(DynArray[uint256, MAX_COINS]) — oracle addresses set at pool deployment, permanently fixed. No admin setter exists. No staleness check in _stored_rates(). Pattern matches F180 failure mode (oracle address not programmatically replaceable). Mitigated: Curve DEX (this slug) has no borrow/liquidation mechanics — rate oracles affect pool re-pegging (AMM curve shape), not user debt liquidation. CryptoSwap v2 (Tricrypto-NG): EMA oracle IS admin-replaceable via factory admin + 3-day timelock (commit_new_parameters / apply_new_parameters) — GREEN for CryptoSwap v2. Net: YELLOW for StableSwap-NG rate oracle class. Explicitly flagged for T-14 promotion review: should F180 ★ apply at full severity for DEX protocols with no liquidation surface?
Sources #
- GitHubCurve Tricrypto-NG main contractCurveTricryptoOptimizedWETH.vy commit_new_parameters(): ma_time admin-replaceable via 3-day timelock — GREEN for CryptoSwap v2retrieved 2026-04-28
- Curve StableSwap-NG main contractCurveStableSwapNG.vy: rate_oracles: immutable(DynArray[uint256, MAX_COINS]) — confirmed immutable declaration; _stored_rates() — no admin setter for oracle addressesretrieved 2026-04-28
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →