★ Oracle source = spot DEX pool (no TWAP)
Convex Finance's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] No spot DEX oracle in any Convex core contract. Source inspection of Booster.sol, CvxLocker.sol, BaseRewardPool.sol, ExtraRewardStashV3.sol, and Interfaces.sol confirms zero oracle calls (no slot0(), getReserves(), consult(), latestAnswer(), latestRoundData(), getPrice()). The cvxCRV/CRV Curve factory pool carries Curve's internal EMA oracle (TWAP-based) inside the Curve pool contract — this oracle is not consumed by any Convex contract. No spot DEX oracle manipulation vector exists in Convex's core path. Scored green: no spot DEX oracle, no TWAP oracle, no oracle of any kind in Convex's executable logic.
Sources #
- URLConvex Finance — January 2023 Update: cvxCRV Staking ChangesConvex Jan 2023 Medium post confirms the cvxCRV/CRV factory pool's internal price oracle is a Curve-native EMA feature inside the Curve pool contract, not a Convex-owned or Convex-consumed oracleretrieved 2026-05-16
- Convex Finance Platform Contracts — Booster.sol (oracle inspection)convex-eth/platform — Booster.sol: imports Interfaces.sol, SafeMath, IERC20, Address, SafeERC20 only; no oracle adapter import; no latestAnswer/latestRoundData call pattern in any functionretrieved 2026-05-16
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →