★ Immutable oracle address
Jupiter's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ — F180 promoted to critical by T-14 2026-04-22. YELLOW, not red.] Jupiter Perps is a closed-source BPF upgradeable program. Oracle account Pubkeys (dovesOracle / dovesAgOracle per custody asset) are stored in on-chain Custody account structs, not as EVM immutable constants. The program has demonstrated oracle account migration capability: the dovesOracle field was superseded by the dovesAgOracle field in a prior program upgrade, confirming that oracle accounts ARE replaceable via program upgrade. However: (a) the upgrade authority for the Perps program (PERPHjGBqRHArX4DySjwM6UJHiR3sWAatqfdBS2qQJu) is not publicly disclosed; (b) oracle replacement requires a full binary upgrade (not a targeted setOracle admin call), creating high operational friction; (c) no timelock on oracle changes has been identified; (d) the program is closed-source, preventing independent verification. PD-023 generalized F180 to non-EVM substrates: 'oracle source address or equivalent is not programmatically re
Sources #
- DocsJupiter Perpetuals program — SolscanProfile §3 — Perps program is BPF upgradeable; upgrade authority not publicly disclosedretrieved 2026-04-29
- Jupiter Perpetuals price oracles — migration notedovesOracle → dovesAgOracle migration confirmed: developers should migrate to new oracle account fieldretrieved 2026-04-29
- Jupiter Perps IDL parsing — oracle address structures in Custody accountCustody account oracle fields (dovesOracle, dovesAgOracle) stored as on-chain Pubkeys per asset — not immutable EVM constantsretrieved 2026-04-29
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →