Arbitrary call with user-controlled target
dYdX v4 (dYdX Chain)'s assessment for RD-F-013 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Arbitrary .call(target, data) is an EVM pattern. Not present in Go Cosmos-SDK message handlers. Not applicable.
Sources #
- GitHub
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol dydx-v4 factor RD-F-013 score not_applicable collected_at 2026-05-17 09:58:47