delegatecall with user-controlled target

Pendle Finance's assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Router uses diamond-facet pattern where facets are pre-registered (not user-supplied). delegatecall targets are whitelisted facet implementations. No user-controlled delegatecall target found in audits or source inspection.

Sources #

GitHub
Pendle Router action contract sourceActionAddRemoveLiqV3 source — diamond-facet architectureretrieved 2026-04-29

Methodology #

Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol pendle factor RD-F-012 score green collected_at 2026-04-28 21:09:40