delegatecall with user-controlled target

Maple Finance's assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Maple uses delegatecall only through the factory-controlled proxy migration pattern (ProxiedInternals._migrate); no user-controlled delegatecall target found in audit reports or source review.

Sources #

GitHub
https://github.com/maple-labs/proxy-factory/blob/main/contracts/ProxiedInternals.solretrieved 2026-04-27

Methodology #

Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol maple-finance factor RD-F-012 score green collected_at 2026-04-27 05:38:08