★ Oracle source = spot DEX pool (no TWAP)
Concrete's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] GREEN. No spot DEX oracle exists in Concrete's vault logic. Share price is pure ERC-4626 cached totalAssets accounting driven by strategy-reported yields. ConcreteStandardVaultImpl.sol contains no oracle import, no latestAnswer(), no latestRoundData(), no TWAP call, no DEX pool price read. Halborn V2 audit (Sep 2025) found zero oracle-related findings. No flash-loan oracle manipulation attack vector exists in the deposit/withdraw/share-price path.
Sources #
- GitHubConcreteStandardVaultImpl.sol — oracle absence confirmedsrc/implementation/ConcreteStandardVaultImpl.sol — full source inspection: no Chainlink import, no oracle interface, no DEX pool call; totalAssets() returns cached state updated by _previewAccrueYieldAndFees()retrieved 2026-05-17
- Halborn Blueprint Finance Earn V2 Core Audit (Sep 2025) — zero oracle findingsHalborn Earn V2 Core (Sep 2025) — 0 critical, 0 high, 0 medium findings; no oracle-related findings in scoperetrieved 2026-05-17
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →