★ Immutable oracle address
Kamino Lend's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL — F180] Oracle address stored in mutable Reserve data account (not BPF binary immutable). Admin can update via lending_market_owner authority using update-reserve-config. Direct Rust struct verification not achieved (GitHub 404). Score yellow pending source confirmation.
Detail #
On Solana, klend reserves store oracle configuration in data accounts governed by LendingMarket.lending_market_owner (expected to be Squads multisig per deployment docs). The klend-sdk README_KAMINO_MANAGER.md documents `yarn kamino-manager update-reserve-config --reserve <address> --reserve-config-path <config.json>` as a standard admin oracle update operation. Solana programs do not use EVM `immutable` keyword — oracle references in data accounts are inherently mutable storage. However, direct Rust source inspection of programs/klend/src/state/reserve.rs was not possible (404). The Solana-native pattern strongly supports mutability, but source-level confirmation would raise confidence to green.
Sources #
- GitHub
- https://github.com/Kamino-Finance/klend/blob/master/README.mdretrieved 2026-05-06
- Kamino Manager README — oracle update operationklend-sdk README_KAMINO_MANAGER.md — update-reserve-config with oracle parametersretrieved 2026-04-27
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →