★ Oracle source = spot DEX pool (no TWAP)
Multipli's assessment for RD-F-053 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL — not red] xToken NAV: off-chain balance push — not a spot DEX read; flash-loan spot manipulation not applicable. rwaUSD stablecoins: external oracle feed + DEX TWAP sanity check — TWAP present. rwaUSD gold: XAU/USD spot + token market TWAP divergence clamp. No confirmed raw spot-DEX oracle without TWAP for any documented asset type. Yellow (not green) because full vault contracts are non-public — cannot rule out undisclosed markets without TWAP guard.
Sources #
- GitHubMultipliVault.sol — no spot DEX oracleMultipliVault.sol — onUnderlyingBalanceUpdate is not a DEX pool read; no oracle imports in public vault sourceretrieved 2026-05-17
- Multipli docs — oracle types per asset classdocs llms-full.txt — rwaUSD stablecoin oracle uses 'external oracle feed + DEX TWAP'; gold uses XAU/USD spot + token market TWAP divergence clampretrieved 2026-05-17
Methodology #
Determine whether the primary oracle for any asset/market reads spot price from a single DEX pool without a TWAP window or secondary source.
See the full factor methodology and distribution across all protocols →