delegatecall with user-controlled target
QuickSwap's assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
V2 UniswapV2Factory/Pair (solc 0.5.16): standard constant-product AMM, no delegatecall usage in core contracts. Algebra V1 core: no user-controlled delegatecall finding in C4 contest (118 wardens, no such finding reported). Direct-deploy per-pool architecture (no proxy) means delegatecall is not the pool deployment pattern.
Sources #
- GitHubQuickSwap V2 Core GitHubQuickSwap V2 core source — no delegatecall in factory/pairretrieved 2026-05-16
- Code4rena 2022-09 QuickSwap ReportC4 — no user-controlled delegatecall finding in 118 warden reportsretrieved 2026-05-16
Methodology #
Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol quickswap factor RD-F-012 score green collected_at 2026-05-16 08:48:31