★ Admin = deployer EOA after 7 days
Multipli's assessment for RD-F-043 — scored red on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[CRITICAL] MultipliBridger deployed 2025-01-15 by 0x151799d9072b0Ca939550906E7E79506bF4BeeE3; same EOA is current owner 16 months later (no OwnershipTransferred event). Avalanche vaults deployed ~10 months ago by 0x8cFee31bf3A57EC2C86D9e0f476Bd36aCA611Fa5; same EOA confirmed as RolesAuthority owner; no transfer to multisig evidenced. Both satisfy admin=deployer EOA condition well beyond 7-day threshold.
Sources #
- TxMultipliBridger deploy — deployer 0x151799d9 confirmed Jan 15 2025MultipliBridger deploy tx 0x894a7fc, block 21,633,281, 2025-01-15retrieved 2026-05-17
- MultipliBridger current owner = original deployer EOAMultipliBridger readContract: owner()=0x151799d9072b0Ca939550906E7E79506bF4BeeE3 — same as deployer 16 months laterretrieved 2026-05-17
- Avalanche RolesAuthority — deployer = current owner, no ownership transferSnowtrace RolesAuthority 0xf580B985: creator = 0x8cFee31b ~10 months ago; last tx 4 months ago, no ownership transferretrieved 2026-05-17
Methodology #
Determine whether, at t = deploy+7d, the admin address still equals the deployer EOA with no evidence of transfer to a multisig.
See the full factor methodology and distribution across all protocols →