Role separation: upgrade ≠ fee ≠ oracle
Jupiter Perpetual Exchange's assessment for RD-F-035 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
IDL shows upgrade (BPFLoaderUpgradeable via Squads v4 AxkJ8oH5...), fee withdrawal (withdrawFees2), and oracle config (setCustodyConfig includes oracle parameters) all controlled by the same program admin role. The Squads v4 4-of-7 multisig is the single authority for all three. No evidence of distinct role separation between upgrade authority and protocol parameter admin.
Sources #
- GitHubAnchor CPI client for Jupiter Perpetuals programJupiter Perpetuals CPI IDL: setCustodyConfig, withdrawFees2, and program upgrade all require admin account — single role; Squads v4 multisig AxkJ8oH5 is the upgrade authority controlling allretrieved 2026-05-16
Methodology #
Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol jupiter-perps factor RD-F-035 score yellow collected_at 2026-05-16 01:53:11