Stale-approval exposure on deprecated router

Convex Finance's assessment for RD-F-168 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

vlCVX v1 contract (0xD18140b...) was deprecated 2022-03; some users may retain token approvals to this contract. Platform docs do not include a dedicated revocation guide or revoke-notice. The v1 contract itself is empty (user funds migrated) so direct loss from stale approvals is low, but the hygiene gap exists. Cannot quantify without on-chain allowance scan. [?]

Sources #

URL
Convex Finance -- vlCVX Contract Migration BlogvlCVX v1 deprecated March 2022; migration to v2 described; no revocation guide mentionedretrieved 2026-05-16

Methodology #

Count the number of active user approvals (ERC-20 `allowance`) to deprecated router or protocol contracts.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol convex-finance factor RD-F-168 score yellow collected_at 2026-05-16 02:41:28