defirisk.co
rubric v1.7.0

Immutable oracle address

Polymarket's assessment for RD-F-180 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

[★ CRITICAL — RED] Primary UMA CTF Adapter (0x6A9D222616C90FcA5754cd1333cFD9b7fb6a4F74) declares IOptimisticOracleV2 public immutable optimisticOracle. No setter function exists. Admin cannot replace oracle address without redeploying adapter and migrating all active markets. Matches F180 definition: oracle source address not programmatically replaceable by admin action without full protocol upgrade. Legacy v1 adapter (0xCB1822859cEF82Cd2Eb4E6276C7916e692995130, since re-tagged on Polygonscan as 'UMA Optimistic Oracle'; verified source class still UmaConditionalTokensBinaryAdapter) has mutable Finder with setFinderAddress() but is not the primary path for new market creation. Partial mitigation: emergency resolution admin bypass exists; Chainlink integration covers price-market class only. F180 fully promoted to star-critical by T-14 2026-04-22.

Sources #

Methodology #

Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol polymarket factor RD-F-180 score red collected_at 2026-04-29 16:25:39