TWAP window duration

Venus Protocol's assessment for RD-F-054 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

ChainlinkOracle and BinanceOracle do not use TWAP (point-in-time). TwapOracle.sol exists in VenusProtocol/oracle repo for PancakeSwap AMM pools. TWAP window for PancakeSwap-based assets not confirmed from available sources. THE incident used multi-source convergence (functionally TWAP-manipulation-equivalent). No TWAP window < 30 min confirmed as active for major assets; thin-liquidity TWAP exposure unconfirmed.

Sources #

GitHub
ChainlinkOracle.sol sourceChainlinkOracle.sol — no TWAP logic presentretrieved 2026-04-28
GitHub
VenusProtocol/oracle GitHub repo treeVenusProtocol/oracle repository tree listing TwapOracle.solretrieved 2026-04-28

Methodology #

For each DEX-TWAP oracle, measure the TWAP window duration in minutes; flag any window < 30 minutes as high risk.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol venus factor RD-F-054 score yellow collected_at 2026-04-28 18:30:49