Market-listing governance threshold
Orca's assessment for RD-F-072 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Applied in DEX-pool-creation context per phase-2 briefing pre-mark. Orca Whirlpools pool creation is fully permissionless: anyone can create a pool within an initialized WhirlpoolsConfig fee-tier space with no governance approval, DAO vote, or multisig action — confirmed by dev.orca.so documentation ('Whirlpools is set up such that anyone is able to set up a liquidity pool within a WhirlpoolsConfig space'). This enables: (a) creation of low-liquidity honey-pot or malicious-token pools visible on-chain; (b) thin-liquidity Whirlpool pools being consumed as TWAP oracle inputs by downstream protocols, creating price manipulation risk for those consumers (not for Orca itself). Mitigations: Orca UI displays a curated/verified pool list (users must deliberately access permissionless pools); fee tiers (9-14 on Solana, 0.01%-2.00%) are governance-controlled at the WhirlpoolsConfig level, not per-pool. Scored yellow (permissionless) per methodology categorical.
Sources #
- URLOrca Whirlpool Parameters — fee authority and config authority roleshttps://dev.orca.so/Architecture%20Overview/Whirlpool%20Parameters/retrieved 2026-05-16
- Orca dev docs — Create Pool: funded wallet required for account rent; no seed-deposit or borrow-enable concepthttps://dev.orca.so/SDKs/Whirlpool%20Management/Create%20Pool/retrieved 2026-05-16
Methodology #
Classify the governance threshold required to list a new market as: permissionless / low-threshold (team multisig) / high-threshold (DAO vote) / no new listings.
See the full factor methodology and distribution across all protocols →