★ Oracle source = spot DEX pool (no TWAP)
Beefy Finance's assessment for RD-F-053 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] Core vaults use NO oracle — no spot DEX exposure for share pricing. BeefySwapper uses DEX-TWAP adapters (UniV2 TWAP, UniV3 TWAP, Solidly TWAP, Algebra TWAP) with TWAP present but NO minimum period enforced in validateData(). CLM uses 60-second Uniswap V3 TWAP for onlyCalmPeriods — below 30-minute safe threshold but not zero-TWAP spot. Chainlink and Pyth adapters available as alternatives. Yellow not red because TWAP is present (not raw spot), but 60-second window is materially short.
Sources #
- DocsBeefy CLM — 60-second TWAP oracle confirmationCLM docs: 'deposits only made in calm periods... pool's TWAP over the last 60 seconds'retrieved 2026-05-16
- BeefyVaultV7.sol — no oracle in vault share pricingBeefyVaultV7.sol — getPricePerFullShare uses balance()/totalSupply() ratio only, no oracleretrieved 2026-05-16
- BeefyOracleUniswapV3.sol — TWAP configuration and validationBeefyOracleUniswapV3.sol — validateData() has no minimum twapPeriod enforcement; UniswapV3OracleLibrary.consult() called with user-supplied periodretrieved 2026-05-16
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →