Arbitrary call with user-controlled target
Sky Lending (formerly MakerDAO)'s assessment for RD-F-013 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
MCD Vat's external calls target pre-registered adapter contracts, not user-supplied addresses. DssFlash (ERC-3156) uses standard flash loan callback pattern with repayment validation. No arbitrary call-with-user-target found.
Sources #
- URLhttps://github.com/sky-ecosystem/dss-flashretrieved 2026-04-27
- https://etherscan.io/address/0x35D1b3F3D7966A1DFe207aa4514C12a259A0492Bretrieved 2026-04-27
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol sky-lending factor RD-F-013 score green collected_at 2026-04-28 00:43:18