★ Oracle source = spot DEX pool (no TWAP)
Axelar Network's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] Bridge value path is validator-set consensus, NOT DEX-priced spot oracle. AxelarGateway.sol contains no oracle call — authentication is delegated to IAxelarAuth(authModule).validateProof(messageHash, proof) which is the validator-weighted signature check. AxelarGasService.sol gas payment is msg.value-based with no oracle-priced valuation. The 19 Chainlink feeds in data cache are peripheral/integrator-side and NOT consumed by Axelar's gateway contracts. Spot DEX oracle attack vector is not present in the bridge architecture.
Sources #
- GitHubAxelarGateway.sol — oracle absence confirmedAxelarGateway.sol execute() — calls IAxelarAuth(authModule).validateProof(); no Chainlink or DEX oracle interface importedretrieved 2026-05-17
- AxelarGasService.sol — no oracle callAxelarGasService.sol — payNativeGasForContractCall accepts msg.value; no oracle price query confirmed by source inspectionretrieved 2026-05-17
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →