ecrecover zero-address return unchecked
Balancer (v2 + v3)'s assessment for RD-F-019 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Balancer v2/v3 core AMM contracts (Vault, pool contracts) do not use ecrecover for security-critical AMM paths. EIP-712 permit is used in periphery (Batch Relayer, v3 Router). No published high/critical finding of unchecked ecrecover return in v2 or v3 audits across 24 audit engagements. Confidence [?] without tool run on all periphery contracts.
Sources #
- AuditTrail of Bits 2022-05-27: Batch Relayer audithttps://github.com/balancer/balancer-v2-monorepo/blob/master/audits/trail-of-bits/2022-05-27.pdfretrieved 2026-05-05
- Balancer v2 audit reports directoryhttps://github.com/balancer/balancer-v2-monorepo/tree/master/auditsretrieved 2026-05-05
Methodology #
Determine whether any `ecrecover` call result is used without a `!= address(0)` guard.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol balancer factor RD-F-019 score green collected_at 2026-05-05 12:41:36