Deprecated contract paused but pause reversible by live admin

Orca's assessment for RD-F-167 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Orca deprecated its legacy AMM v1 (non-concentrated pools) in Q1 2023 and placed them in withdrawal-only mode. As of mid-2023 approximately $9M remained in legacy contracts. The legacy program is a separate BPF program; whether its upgrade authority was set to the same Squads multisig or was immutably frozen is not confirmed in this session. If the upgrade authority was not renounced/frozen, the live admin could theoretically re-enable deposit functionality. Yellow with low confidence pending on-chain verification of legacy program upgrade authority status.

Sources #

URL
Gemini Cryptopedia — Orca AMM v1 launched February 2021https://www.gemini.com/cryptopedia/orca-crypto-exchange-solana-dex-orca-tokenretrieved 2026-05-16
Docs
Orca documentation — DEX/AMM; no stablecoin producthttps://docs.orca.soretrieved 2026-05-16

Methodology #

Determine whether a deprecated-and-paused contract's pause state is revertible by a currently-live admin role.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol orca factor RD-F-167 score yellow collected_at 2026-05-16 02:39:16