Role separation: upgrade ≠ fee ≠ oracle
M^0's assessment for RD-F-035 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core protocol has no fee, oracle, or upgrade roles — all governed by TTG. Periphery proxy admin (upgrade role) is the same deployer EOA that controls setSupportedBridgingPath() and other admin functions. Role separation N/A for core but absent for periphery.
Sources #
- EtherscanHubPortal Proxy — EtherscanHubPortal source: onlyOwner gates setDestinationMToken() and setSupportedBridgingPath(); same EOA as upgrade adminretrieved 2026-05-16
- SwapFacility Proxy — EtherscanSwapFacility proxy admin = owner EOA: same address for upgrade and admin functionsretrieved 2026-05-16
Methodology #
Determine whether the upgrade role, fee-collection role, and oracle-config role are assigned to distinct addresses.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol m0 factor RD-F-035 score yellow collected_at 2026-05-16 09:46:19