★ Oracle source = spot DEX pool (no TWAP)
Symbiotic's assessment for RD-F-053 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL — NOT_APPLICABLE] Symbiotic core does not use any DEX pool as a price oracle. No slot0(), getReserves(), consult(), or observe() call found in any core contract. Collateral is tracked at nominal ERC-20 balance. Verified across Vault.sol, DefaultCollateral.sol, Slasher.sol, VetoSlasher.sol, BaseSlasher.sol, FullRestakeDelegator.sol. No spot-DEX oracle risk present in the core primitive.
Sources #
- GitHubSymbiotic FullRestakeDelegator.sol — F053 critical verificationFullRestakeDelegator.sol — only external call is IVault.activeStakeAt(); no DEX oracleretrieved 2026-05-16
- Symbiotic Vault.sol — F053 critical verificationVault.sol source inspection — zero oracle imports; no slot0/getReserves/consult callsretrieved 2026-05-16
- Symbiotic VetoSlasher.sol — F053 critical verificationVetoSlasher.sol — no oracle calls; slashing amount determined by stake units onlyretrieved 2026-05-16
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →