★ Immutable oracle address
Veda (BoringVault)'s assessment for RD-F-180 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
[★ CRITICAL-CANDIDATE PD-017] Rate provider addresses in AccountantWithRateProviders are stored in a MUTABLE mapping (mapping(ERC20 => RateProviderData) public rateProviderData). The setRateProviderData(ERC20 asset, bool isPeggedToBase, address rateProvider) external requiresAuth function allows authorized admins to replace any rate provider. Emits RateProviderUpdated event. Rate provider addresses are NOT immutable. Score: green — admin can replace oracle source if needed.
Sources #
- GitHubAccountantWithRateProviders.sol sourceAccountantWithRateProviders.sol — RateProviderData struct (rateProvider field not immutable); setRateProviderData function body; emit RateProviderUpdated eventretrieved 2026-05-17
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →