★ Immutable oracle address

Venus Protocol's assessment for RD-F-180 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

[★ CRITICAL per T-14] ResilientOracle stores feed addresses in governance-replaceable mappings. Functions confirmed in source: setOracle(asset, oracle, role), setTokenConfig(TokenConfig), enableOracle(asset, role, bool). Oracle addresses are NOT EVM immutable. Governance (via VIP + applicable Timelock tier) can replace any oracle for any asset. Compound-fork pattern preserves this replaceability — oracle is an external call to a mutable mapping. GREEN: no immutable oracle address risk.

Sources #

GitHub
ResilientOracle.sol sourceResilientOracle.sol setOracle(), setTokenConfig(), enableOracle() functionsretrieved 2026-04-28

Methodology #

Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol venus factor RD-F-180 score green collected_at 2026-04-28 18:30:49