delegatecall with user-controlled target

Curve Finance's assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Vyper does not natively support delegatecall at the language level. Inspection of core pool contracts shows no delegatecall patterns. Pool contracts are non-upgradeable and make only standard interface calls to external contracts (tokens, wrappers). Confirmed across CurveTricryptoOptimizedWETH.vy, CurveStableSwapNG.vy, VotingEscrow.vy.

Sources #

GitHub
CurveTricryptoOptimizedWETH.vy source inspectionCurveTricryptoOptimizedWETH.vy — no delegatecallretrieved 2026-04-28
GitHub
VotingEscrow.vy source inspectionVotingEscrow.vy — no delegatecall confirmedretrieved 2026-04-28

Methodology #

Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-012 score green collected_at 2026-04-28 19:48:40