Deprecated contracts still holding value
Balancer (v2 + v3)'s assessment for RD-F-166 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
v2 TimelockAuthorizer (0x9E3cD0606Db55ac68845bB60121847823712ae05) is flagged DEPRECATED in balancer-deployments registry. It is an access-control contract not holding user TVL; direct balance ~$0. v2 CSPv6 factory disabled; individual v6 pools remain deployed in Recovery Mode with residual TVL (post-exploit user exit has substantially drained but exact residual unknown without live RPC). Stale approvals to the v2 Vault (which routes v6 pools) persist for users who have not revoked. Score: yellow (deprecated contract directly holds $0 TVL; broader deprecated v6 pool surface residual is uncertain but likely below $100K per contract; stale approval surface exists but not quantified).
Sources #
- GitHubhttps://github.com/balancer/balancer-deployments/blob/master/addresses/mainnet.jsonretrieved 2026-05-05
- https://etherscan.io/address/0x9E3cD0606Db55ac68845bB60121847823712ae05retrieved 2026-05-05
Methodology #
Determine whether contracts marked deprecated by a protocol announcement still hold >$100K in assets.
See the full factor methodology and distribution across all protocols →