Role separation: upgrade ≠ fee ≠ oracle

Sanctum's assessment for RD-F-035 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

On Solana, EVM-style role separation does not map cleanly. Program upgrade authority (Squads multisig) likely also controls fee parameters for Infinity/Router/Unstake. No oracle role exists (Sanctum does not use external oracles — F053 pre-marked green by profiler). Two-of-three role separation: upgrade and fee-admin appear co-located in same multisig; oracle role N/A. Partial separation only.

Sources #

Docs
Exploring Sanctum On-Chain: A Deep Dive with SolanaFMProfile §7: no external oracle; profile §3: upgrade authority = Sanctum Multisig (implied fee admin co-location)retrieved 2026-05-04

Methodology #

Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol sanctum factor RD-F-035 score yellow collected_at 2026-05-04 18:49:23