Arbitrary call with user-controlled target
Centrifuge's assessment for RD-F-013 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No arbitrary call with user-controlled target and data found in Centrifuge V3/V3.1. Gateway.sol withBatch() calls msg.sender.call{value}(data) but target is always msg.sender (self-callback, not arbitrary), protected by lockCallback() verification. VaultRouter.sol calls typed vault interfaces. No unfiltered arbitrary-call external target found.
Sources #
- GitHubGateway.sol withBatch — msg.sender.call self-callback patterncentrifuge/protocol Gateway.sol withBatch() functionretrieved 2026-04-28
- VaultRouter.sol — typed interface constraints on vault callscentrifuge/protocol VaultRouter.sol typed interface callsretrieved 2026-04-28
- https://code4rena.com/reports/2023-09-centrifugeretrieved 2026-04-28
Methodology #
Determine whether any contract performs `.call(target, data)` where target and/or data is user-supplied without a target allowlist or selector filter.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol centrifuge factor RD-F-013 score green collected_at 2026-04-30 21:19:10