defirisk.co
rubric v1.7.0

★ Admin = deployer EOA after 7 days

Meteora's assessment for RD-F-043 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

DLMM upgrade authority is off-curve PDA (Squads v3 vault PDA), not a deployer EOA. Governance has been multisig-controlled since at least the Mercurial/Meteora rebrand era (2022-2023). The protocol was not launched with a deployer EOA retaining admin power. No evidence of a single EOA deployer holding admin rights beyond 7 days.

Sources #

  • Internal
    Meteora Protocol Profile — Upgrade Authority Type.research/protocols/meteora/00-profile.md §3 — dlmm_upgrade_authority_type: off-curve PDA (Squads v3 vault)retrieved 2026-05-16
  • Internal
    Orchestrator DLMM upgrade authority classificationOrchestrator derivation: DLMM upgrade authority is off-curve PDA, not EOAretrieved 2026-05-16

Methodology #

Determine whether, at t = deploy+7d, the admin address still equals the deployer EOA with no evidence of transfer to a multisig.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol meteora factor RD-F-043 score green collected_at 2026-05-16 10:03:05