delegatecall with user-controlled target
Frax Finance's assessment for RD-F-012 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No Slither controlled-delegatecall detector run available. frxGov system (OZ Governor extension) audited by ToB Jul 2023 with no such finding cited. AMO contracts (Curve AMO, Convex) involve delegatecall patterns potentially — tool run required.
Sources #
- Curator notedelegatecall analysis gapTool run not available; ToB Jul 2023 frxGov audit found no delegatecall issue but AMO contracts not independently verifiedretrieved 2026-05-17
Methodology #
Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol frax factor RD-F-012 score gray collected_at 2026-05-16 20:44:31