★ Immutable oracle address
Fluid's assessment for RD-F-180 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] Oracle addresses are NOT immutable in Fluid vault contracts. The VaultT1AdminModule includes an updateOracle(address newOracle_) function that allows admin to replace the oracle address. The oracle is stored in vaultVariables2 storage (packed with other variables), not in an immutable variable. The _verifyCaller modifier restricts calls to delegatecall from the vault core contract (authorized admin path), not direct EOA. The VaultTypesCommon admin module similarly has updateOracle(uint newOracleNonce_) deriving the new oracle address from the nonce via AddressCalcs. This means when an oracle source becomes compromised or an asset depegs, governance can replace the oracle without a full contract upgrade. F180 green — oracle replaceability exists via admin.
Sources #
- GitHubVaultT1 Admin Module — updateOracle functionInstadapp/fluid-contracts-public/contracts/protocols/vault/vaultT1/adminModule/main.sol — updateOracle(address newOracle_) function present; oracle stored in vaultVariables2 (mutable storage)retrieved 2026-04-29
- VaultTypesCommon Admin Module — updateOracle functionInstadapp/fluid-contracts-public/contracts/protocols/vault/vaultTypesCommon/adminModule/main.sol — updateOracle(uint newOracleNonce_) using AddressCalcsretrieved 2026-04-29
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →