★ Admin has mint() with unlimited max

Venus Protocol's assessment for RD-F-042 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

VAI.sol has unlimited mint(address usr, uint256 wad) gated by auth modifier (wards[msg.sender] == 1). No supply cap on VAI. VAI minting authorization requires governance VIP to add new wards (Normal Timelock, 48h delay). XVS has fixed 30M supply, no mint. Yellow: VAI is uncapped but mint authorization is governance-timelocked — not single-EOA accessible.

Sources #

GitHub
XVS.sol — totalSupply = 30000000e18; no mint functionXVS.sol fixed supplyretrieved 2026-04-28
GitHub
VAI.sol — unlimited mint gated by auth (wards); no capVAI.sol mint functionretrieved 2026-04-28

Methodology #

Determine whether an admin-callable `mint` on a protocol token has no supply cap or an unlimited maximum supply.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol venus factor RD-F-042 score yellow collected_at 2026-04-28 18:30:49