★ Immutable oracle address
Jupiter Perpetual Exchange's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CANDIDATE — PD-017] Jupiter Perps is a closed-source BPF program on Solana. Oracle price accounts (Doves accounts per IDL: DoVEsk76QybCEHQGzkvYPWLQu9gzNoZZZt3TPiL597e) are referenced in the perps program. IDL-parsing reference hardcodes five per-asset oracle account addresses in CUSTODY_DETAILS, suggesting they are fixed account references in program instructions. Solana has no 'immutable' keyword — the F180 EVM-immutable pattern does not apply directly. However: (1) the closed-source binary prevents confirmation of whether an admin 'updateCustody' instruction exists to change oracle account references without a full binary upgrade; (2) in Solana, changing which oracle account the program reads requires either a dedicated admin instruction OR a full program upgrade via the upgrade authority; (3) the Doves oracle accounts themselves are updateable by the Chaos Labs keeper (the price data within them can be replaced), which is the intended operation — price data flows in, not oracle a
Sources #
- URLChaos Labs Edge Oracle — Keeper Update MechanismChainwire 2024-09-12 — Chaos Labs Edge described; Doves oracle accounts updated by keeper, confirming price data replaceability within oracle accounts (not oracle account reference replaceability)retrieved 2026-05-16
- Jupiter Perps BPF Program — SolscanProfile §11 — perps program is closed-source BPF; no public jup-ag/perps contract repository found; prevents verification of admin oracle-update instructionsretrieved 2026-05-16
- Jupiter Perps IDL — Hardcoded Oracle Account Referencesjulianfssen/jupiter-perps-anchor-idl-parsing poll-and-stream-oracle-price-updates.ts — CUSTODY_DETAILS hardcodes five Doves oracle account addresses, indicating fixed account references in programretrieved 2026-05-16
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →