★ Post-audit code changes without re-audit
Jupiter's assessment for RD-F-139 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
CRITICAL: Jupiter Aggregator v6 is a closed-source binary. The metis-binary repo shows 9+ releases in 5 months (Dec 2024–Apr 2025) after the April 2024 Offside Labs audit. October 2025 Offside Labs re-audit covers the state at that time, but: (1) whether metis-binary releases correspond to on-chain program upgrades cannot be confirmed; (2) post-October 2025 binary updates are likely given the release cadence; (3) source unavailability makes it structurally impossible to verify that the deployed binary corresponds to any audited state at any time. By construction, a closed-source binary with frequent updates cannot have all updates independently verified against audit coverage.
Sources #
- GitHubJupiter metis-binary releases | GitHubjup-ag/metis-binary — 9+ releases post-April 2024 auditretrieved 2026-04-29
- Jupiter Swap v6 Offside Labs Audit October 2025Offside Labs Aggregator v6 re-audit (October 2025)retrieved 2026-04-29
- Jupiter Swap v6 Offside Labs Audit April 2024Offside Labs Aggregator v6 audit (April 2024) — latest comprehensive audit pre-binary releasesretrieved 2026-04-29
Methodology #
Count deployed changes to audited bytecode where no subsequent audit or spot-review covers the changed code.
See the full factor methodology and distribution across all protocols →