ecrecover zero-address return unchecked

Yearn Finance's assessment for RD-F-019 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

V3 VaultV3.vy and V2 Vault.vy do not use ecrecover in core vault logic — ERC-4626 with no meta-transaction in core. Solidity periphery uses OZ 4.9.5 SafeERC20 which handles ecrecover correctly. No ecrecover calls without address(0) guard identified.

Sources #

GitHub
VaultV3.vy — no ecrecover in core vault logicVaultV3.vy source — no ecrecover in coreretrieved 2026-05-16

Methodology #

Determine whether any `ecrecover` call result is used without a `!= address(0)` guard.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol yearn-finance factor RD-F-019 score green collected_at 2026-05-16 08:34:32