★ Immutable oracle address
A oracle & external dependencies factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor checks whether the protocol has hard-coded an oracle address — using the EVM `immutable` keyword, a non-EVM hardcoded constant, or a closed-source binary oracle embedding — such that the address cannot be replaced by an authorised admin without deploying new contract code. Source inspection, on-chain reads, and protocol documentation are used across all substrate types (EVM, non-EVM, closed-source).
**Why it matters** An oracle that cannot be swapped out by an admin becomes a single load-bearing dependency with no operational escape valve. Even a high-quality aggregated feed (Chainlink, Pyth) becomes a critical failure point if the asset it prices depegs, the feed is deprecated, or the aggregator experiences an incident — because the protocol has no path to emergency substitution. The 2024–2026 period produced four stablecoin-oracle incidents in 14 months (USR, USDX, xUSD, USD0++) where immutable oracle addresses prevented the protocol from reacting to peg events, leading to this factor being promoted to critical status under rubric v1.4 in April 2026. This failure mode is orthogonal to RD-F-053: a protocol can use a Chainlink-grade source yet still be critically exposed if it cannot replace that source when the underlying asset or feed fails.
**Green / Yellow / Red** Green is scored when an admin-replaceable oracle wrapper exists with a governance-controlled setter, a timelock, and documented change procedures. Yellow is scored when the setter exists but is undocumented, uses an EOA without multisig, or has no timelock. Red is scored when the oracle address is hardcoded (`immutable`, compile-time constant, or opaque binary) with no admin path to replacement.
**Common gray cases** Gray is applied when source code is unavailable or partially verified and the oracle binding mechanism cannot be confirmed from inspection alone.
**Notable historical examples** No cross-hacked incidents are currently linked in the database for this factor.
**★ Critical factor** This factor alone is sufficient to trigger a D or F grade under rubric v1.7.0. Immutable oracle binding removes the protocol team's last operational lever to respond to feed failure, depeg, or aggregator incidents — transforming any oracle weakness into an unrecoverable structural exposure.
Measurement what to look for #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.