★ Immutable oracle address
GMX v2 (GMX Synthetics)'s assessment for RD-F-180 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CANDIDATE — PD-017, held from critical-19 count. T-14 tracking required.] Oracle provider addresses are NOT immutable per-asset in GMX v2. Oracle.sol reads oracle provider per-token from DataStore via `dataStore.getAddress(Keys.oracleProviderForTokenKey(address(this), token))`. DataStore is configurable by CONTROLLER role (team via 5-of-8 Safe + Timelocks). Oracle providers can be swapped without redeploying Oracle.sol. Oracle.sol has three immutable constructor variables (DataStore, EventEmitter, sequencerUptimeFeed) — these are infrastructure references, not per-asset price feed addresses. Per-asset oracle routing is fully admin-replaceable. Contrast with Morpho Blue's immutable market-level oracle (F180 = RED for morpho-v1).
Detail #
Oracle.sol source inspection: `address expectedProvider = dataStore.getAddress(Keys.oracleProviderForTokenKey(address(this), token))` — confirmed dynamic lookup, not immutable. DataStore Arb 0xFD70de6b91282D8017aA4E741e9Ae325CAb992d8 holds this mapping and is admin-configurable. Template: green = oracle address configurable via admin setter with timelock (DataStore changes go through CONTROLLER role + relevant Timelock path).
Sources #
- EtherscanDataStore — ArbiscanDataStore Arbitrum 0xFD70de6b91282D8017aA4E741e9Ae325CAb992d8 — configurable by CONTROLLER roleretrieved 2026-05-05
- Oracle.solOracle.sol — dataStore.getAddress(Keys.oracleProviderForTokenKey) — dynamic provider lookupretrieved 2026-05-05
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →