★ Oracle source = spot DEX pool (no TWAP)
Kinetiq's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL — GREEN] kHYPE exchange rate is computed as (totalStaked + rewardsAmount - totalClaimed - slashingAmount) * 1e18 / totalKHYPESupply in StakingAccountant._getExchangeRatio(). This is on-chain accounting from staking balances — no DEX spot price, no AMM price oracle, no LP token balanceOf. Validator performance scores are operator-pushed from L1 reads, not from any DEX. F053 does not fire.
Sources #
- EtherscanStakingAccountant — HyperEVMScanStakingAccountant proxy 0x9209648Ec9D448EF57116B73A2f081835643dc7A — source verified, no external price oracle calls in implementation 0x1BbFE538ccebe1df35c2ebe35203d40cb18fdae0retrieved 2026-05-17
- StakingAccountant.sol — Code4rena audit repoStakingAccountant.sol _getExchangeRatio(): uint256 totalHYPE = totalStaked + rewardsAmount - totalClaimed - slashingAmount; return Math.mulDiv(totalHYPE, 1e18, totalKHYPESupply); — pure on-chain accounting, no DEX price feedretrieved 2026-05-17
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →