★ Oracle source = spot DEX pool (no TWAP)
mETH Protocol's assessment for RD-F-053 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL] mETH exchange rate is NOT derived from a DEX spot pool. Rate computed from Beacon Chain validator balance accounting via off-chain committee. Staking.sol::totalControlled() reads oracle.latestRecord() which returns currentTotalValidatorBalance and deposit accounting — Beacon Chain data, not a DEX price. No TWAP needed because no DEX pool is used. No flash-loan manipulation vector applies.
Sources #
- DocsmETH Staking Contracts — Oracle descriptionmETH Protocol Oracle and OracleQuorumManager contract description — committee-based validator accountingretrieved 2026-05-16
- Oracle.sol OracleRecord struct — Beacon Chain accountingmantle-lsp/contracts src/Oracle.sol — OracleRecord struct containing currentTotalValidatorBalance and deposit accounting fields; no DEX pool referenceretrieved 2026-05-16
- Staking.sol totalControlled() — oracle.latestRecord()mantle-lsp/contracts src/Staking.sol — totalControlled() function calls oracle.latestRecord(); ethToMETH() formula uses totalControlled/mETHSupply ratioretrieved 2026-05-16
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →