★ Immutable oracle address
Yearn Finance's assessment for RD-F-180 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No oracle address is stored as immutable in any assessed Yearn contract. V2 BaseStrategy.sol: baseFeeOracle declared as mutable public state variable (address public baseFeeOracle), updateable via setBaseFeeOracle(address _baseFeeOracle) external onlyVaultManagers — admin-settable, not immutable. V3 BaseStrategy.sol (tokenized-strategy repo): only immutables are asset (ERC-20 token address) and tokenizedStrategyAddress (implementation contract pointer — not an oracle). No oracle address exists in V3 base strategy. V3 AprOracle: uses mapping(address => address) public oracles — admin-settable via setOracle(address _strategy, address _oracle) external, gated by governance or strategy management. Vault core (V2 + V3) has no oracle address at all. NOTE FOR ORCHESTRATOR: F180 is promoted ★ under rubric v1.4 (T-14 2026-04-22) but held as critical-CANDIDATE for counting per T-12 PD-017. Score is green so has no grade impact.
Sources #
- GitHubYearn V3 BaseStrategy.sol (tokenized-strategy)V3 BaseStrategy.sol: only immutables are asset and tokenizedStrategyAddress — no oracle address storedretrieved 2026-05-16
- Yearn V3 AprOracle — Etherscan sourceV3 AprOracle 0x1981AD9F44F2EA9aDd2dC4AD7D075c102C70aF92: mapping(address => address) public oracles; setOracle() gated by governance/management — not immutableretrieved 2026-05-16
- Yearn V2 BaseStrategy.sol — baseFeeOracle declarationV2 BaseStrategy.sol: address public baseFeeOracle; setBaseFeeOracle() onlyVaultManagers — mutable, admin-settableretrieved 2026-05-16
Methodology #
Determine whether any collateral oracle address is marked `immutable` in protocol config with no admin-replaceable adapter wrapper, preventing the protocol from repricing when the upstream asset depegs.
See the full factor methodology and distribution across all protocols →