★ Oracle source = spot DEX pool (no TWAP)
Frax Finance's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL — GREEN] Fraxlend uses dual Chainlink feeds (_oracleMultiply / _oracleDivide) confirmed by Code4rena 2022 audit: 'The _updateExchangeRate function calls latestRoundData() on both the oracleMultiply and oracleDivide Chainlink oracles.' No spot DEX pool oracle in any product. frxUSD uses Chainlink and governance reference rates. sfrxETH rate is internal ERC-4626 math. Fraxswap is a DEX but does not use an external spot oracle for its own TWAMM pricing. No protocol in the Frax stack reads a raw spot DEX pool price without TWAP or fallback.
Sources #
- DocsFrax Oracle OverviewFrax Oracle Overview — Chainlink-compatible dual oracle, not spot DEX poolretrieved 2026-05-17
- Code4rena Fraxlend 2022 Audit ReportCode4rena 2022-08-frax Fraxlend contest — oracle architecture description: dual Chainlink feeds, latestRoundData() usageretrieved 2026-05-17
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →