Constructor args match governance proposal
A governance & admin factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether the constructor arguments of the deployed contract match the arguments stated in any governance proposal or documentation that authorized the deployment. The assessment compares the on-chain constructor calldata from the deploy transaction against the proposal text, audit report, or governance vote that described the intended deployment parameters.
**Why it matters** Silent deviations between what governance approved and what was actually deployed are a category of insider or deployment-process attack. A proposer who controls both the deployment and the proposal wording can submit a governance vote describing deployment parameters that differ from the bytecode actually deployed. Auditors typically review the described parameters against the source code; they do not independently verify that the deployed bytecode's constructor arguments match the governance proposal wording. This gap creates a window for concealed parameter changes that alter protocol behavior without triggering alarm.
**Green / Yellow / Red** Green is assigned when constructor arguments in the deploy transaction are verified to match the governance proposal or documentation describing the deployment, with on-chain proof available. Yellow covers cases where a partial match is established but one or more parameters cannot be confirmed against proposal text. Red is assigned when a material discrepancy exists between deployed constructor arguments and the governance proposal, or when no proposal exists for a material parameter configuration.
**Common gray cases** This factor is grayed when the protocol deployed before any governance proposal mechanism existed, or when constructor args are not human-readable without ABI decoding and the source ABI is unavailable.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether the deployed contract's constructor arguments match what the governance proposal or deploy announcement stated.