Test-mode parameters in deploy

Methodology how we score #

**What this measures** This factor identifies whether a deployed contract retains test-mode configuration parameters — such as a test oracle address, infinite token allowances for deployer addresses, an admin role still set to the deployer EOA, or debug-level access control conditions. These are parameters that are appropriate in a testing environment but represent active security vulnerabilities in production. Detection combines static analysis of the deployed configuration against the declared production parameter set.

**Why it matters** Test-mode configurations left active in production have caused several significant exploits. Eminence Finance lost $15M because speculative depositors found and funded what was effectively a development contract that had not been made production-safe. The pattern of "deployed to mainnet before final hardening" appears across multiple incidents in the evidence base — particularly in newly deployed contracts and contracts deployed as part of a rapid upgrade cycle. The risk is not the test-mode configuration alone but the combination of that configuration with live user funds: a debug admin address or infinite allowance in production is an immediately exploitable state.

**Green / Yellow / Red** Green is assigned when source inspection and on-chain configuration confirm no test-mode parameters are active in the production deployment. Yellow covers cases where minor non-security-critical test parameters remain (e.g., verbose event emissions) but no privilege-escalating test configs are present. Red is assigned when any privilege-escalating test-mode configuration is found in the production deployment — including deployer-admin, infinite allowances for test addresses, or a mock oracle address.

**Common gray cases** This factor is grayed when source code is unavailable and bytecode-level configuration analysis is inconclusive.

**Notable historical examples** - **Eminence Finance** ($15M, 2020): Protocol deployed to mainnet in development state; speculative deposits funded what was essentially a test contract. - **Compound Finance** ($147M at risk, 2021): Proposal 62 introduced a governance upgrade with test-level parameter assumptions. - **Penpie** ($27M, 2024): Permissionless market registration accepted external contracts without the whitelist that the production spec required.

Measurement what to look for #

Determine whether the deployed configuration retains test-mode parameters (test oracle address, infinite allowance, admin = deployer EOA).

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 14 historical incidents #