defirisk.co
rubric v1.7.0

Oracle source = spot DEX pool (no TWAP)

Curve Finance's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

[★ CRITICAL] GREEN — N/A for swap pricing. Curve's AMMs are self-contained; swap price derived from pool balances via StableSwap/CryptoSwap invariant math, not from any external DEX pool oracle. StableSwap-NG rate oracles (wstETH etc.) use protocol-specific rate functions (getPooledEthByShares type calls), not spot DEX pool prices. CryptoSwap v2 internal EMA uses trade history from the pool itself, not an external DEX spot price. No single DEX pool oracle dependency found in either AMM type.

Sources #

  • GitHub
    Curve Tricrypto-NG main contractCurveTricryptoOptimizedWETH.vy — full contract source, no Chainlink or DEX oracle import; tweak_price() is internal EMA onlyretrieved 2026-04-28
  • GitHub
    Curve StableSwap-NG main contractCurveStableSwapNG.vy — _stored_rates() calls token-specific rate function (not DEX spot price)retrieved 2026-04-28

Methodology #

Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol curve-v2 factor RD-F-053 score green collected_at 2026-04-28 19:48:40