★ Immutable oracle address
Meteora's assessment for RD-F-180 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
CRITICAL-CANDIDATE F180 (PD-017): NOT_APPLICABLE for Meteora. Core swap programs (DLMM, DAMM v1/v2, DBC, Stake2Earn) consume no external oracle address — there is no hardcoded or immutable oracle address to assess. Dynamic Vault calls into lending protocol CPI endpoints (Solend, Tulip) but does not embed a hardcoded Pyth/Switchboard feed address as its own oracle price source. No EVM-immutable equivalent oracle pattern exists in Meteora's Solana programs. The immutable-oracle-address failure mode (USR/USDX/xUSD/USD0++ pattern) requires a lending protocol with hardcoded collateral price feed — Meteora is a DEX/AMM, not a lending protocol. Orchestrator note: F180 critical-CANDIDATE per PD-017 tracked separately.
Sources #
- GitHubMeteoraAg/damm-v2 GitHub RepositoryMeteoraAg/damm-v2: no oracle module in programs/cp-amm source tree; constant-product math is fully internalretrieved 2026-05-16
- Meteora 00-profile.meta.jsonProfile oracle_in_swap_path=false; oracle_note confirms no external oracle in DLMM swap pathretrieved 2026-05-16
- MeteoraAg/dynamic-bonding-curve GitHub RepositoryMeteoraAg/dynamic-bonding-curve lib.rs: no oracle address variable; imports are anchor_lang + internal modules onlyretrieved 2026-05-16
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →