★ Immutable oracle address
StakeWise v3's assessment for RD-F-180 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL-CANDIDATE per T-12 PD-017] Yellow. The Keeper oracle operator set is NOT EVM-immutable: addOracle(address) and removeOracle(address) are onlyOwner functions (Keeper owner = DAO Treasury Safe 0x144a98, 4-of-7). rewardsMinOracles and validatorsMinOracles are mutable via onlyOwner setters. Oracle set can be replaced by 4-of-7 Safe signing immediately (no Snapshot vote required, no timelock). Separately, PriceFeed 0x8023518b constructor-embeds OsTokenVaultController address with no admin setter — this sub-dependency IS effectively immutable within the PriceFeed contract (no setOsTokenVaultController function). OsTokenVaultController itself is Ownable2Step and has admin paths. Scored yellow (not red): (1) Keeper oracle set IS replaceable by DAO Safe; (2) 11-node, 6-of-11 consensus reduces per-node criticality; (3) PriceFeed immutability is mitigated because OsTokenVaultController has its own admin path and a new PriceFeed could be deployed. FLAG: PD-017 CRITICAL-CANDIDATE — orch
Sources #
- EtherscanPriceFeed — Etherscan sourcePriceFeed 0x8023518b source: _osTokenVaultController address set in constructor with no admin setter — effectively immutable for this contractretrieved 2026-05-16
- KeeperOracles.sol — stakewise/v3-coreKeeperOracles.sol: addOracle/removeOracle are external override onlyOwner; mapping(address => bool) isOracle — mutable, not immutableretrieved 2026-05-16
- DAO Treasury | StakeWise V3 DocsGovernance docs confirm DAO Safe 0x144a98 owns Keeper oracle management; vault owner can add/remove oracles through DAO governanceretrieved 2026-05-16
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →