Post-mortem published within 30 days
Convex Finance's assessment for RD-F-082 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Dec 2021 OZ event: OZ published their disclosure post in December 2021 (same day patch applied). Mar 2022 vlCVX: Convex published Medium post March 4, 2022 (same day as v2 contract deployment). Both events have public communication within 24 hours. Scored yellow rather than green because the Mar 2022 post is a migration guide (not a full post-mortem with root-cause analysis and code diff) — meets the 30-day threshold but quality is below the green standard.
Sources #
- URLVote-Locked CVX Contract Migration — Convex Finance MediumConvex vlCVX Medium post — published March 4, 2022 same day as v2 deploymentretrieved 2026-05-16
- OpenZeppelin: Convex Finance Vulnerability DisclosureOZ disclosure post — published same day as patch (Dec 2021)retrieved 2026-05-16
Methodology #
Determine whether a public post-mortem was published within 30 days of the most recent incident.
See the full factor methodology and distribution across all protocols →