Tempo: who can change what the oracle reads

14 targets on Tempo mainnet are tracked and scored by an oracle on Tempo Moderato, the testnet: the stablecoins of the chain (TIP-20 tokens), the Morpho vaults and Morpho Blue, and the validator registry. On Tempo a token's roles are held in a precompile, so the authority is read from role events and from the account that holds each role.

What a track judge can check in two minutes

Three calls on the Tempo (Moderato) oracle, replayed at the block the Watch read (39731343). They need a public RPC and cast (Foundry) and nothing from us. If your RPC does not keep that block, drop --block: the answers change when the oracle is re-pushed.

RPC=https://rpc.moderato.tempo.xyz
ORACLE=0x50840a7667baEa9D05ad4ae3dCeb384724b58720
TARGET=0x20c000000000000000000000b9537d11c60e8b50   # USDC.e

# 1. how many contracts this oracle tracks
cast call $ORACLE "trackedTargetsCount()(uint256)" --rpc-url $RPC --block 39731343

# 2. its score, five sub-scores then the composite, then lastUpdated and the method hash
cast call $ORACLE "getScore(address)((uint8,uint8,uint8,uint8,uint8,uint8,uint64,bytes32))" $TARGET --rpc-url $RPC --block 39731343

# 3. is that score older than maxStaleness
cast call $ORACLE "isStale(address)(bool)" $TARGET --rpc-url $RPC --block 39731343

Expected

1 -> 14
2 -> (65, 98, 0, 100, 80, 55, 1791856659, 0x0a3df5ccf0492a8006278d8f559a8ee72202d8b3d3b01ff5561fa9729045c276)   admin, multisig, timelock, price feed, shared signers, composite
3 -> false

3 findings, each with its replay

1. One 5-of-7 signer quorum holds every role of USDC.e on Tempo and also owns the Stargate USDC pool on Ethereum

On Tempo, the bridged USDC (USDC.e) has one administrator for admin, pause, unpause and burn-blocked: a LayerZero OneSig that needs 5 of its 7 signers, all plain keys. The issuer role is held by the Stargate OFT contract, which the same OneSig owns, and the OneSig has no delay. The same seven signers, at threshold 5, own the Stargate USDC pool on Ethereum, so one quorum controls both the collateral side and the minted side of the route. The admin role can grant the issuer role to any address at once, so that quorum can mint USDC.e outside the bridge. A 5-of-7 threshold is the strongest authority found on Tempo.

Replay it (public data, no key)

# the OneSig holds the admin role of USDC.e, the OFT holds the issuer role, and the OFT is owned by the OneSig
T=https://rpc.tempo.xyz
USDC=0x20C000000000000000000000b9537d11c60E8b50
OFT=0x8c76e2F6C5ceDA9AA7772e7efF30280226c44392
OS=$(cast call $OFT "owner()(address)" --rpc-url $T)
cast call $USDC "hasRole(address,bytes32)(bool)" $OS 0x0000000000000000000000000000000000000000000000000000000000000000 --rpc-url $T
cast call $USDC "hasRole(address,bytes32)(bool)" $OFT $(cast keccak ISSUER_ROLE) --rpc-url $T
# -> true, then true
# the OneSig: threshold and number of signers
cast call $OS "threshold()(uint256)" --rpc-url $T
cast call $OS "getSigners()(address[])" --rpc-url $T | tr ',' '\n' | wc -l
# -> 5, then 7
# the owner of the Stargate USDC pool on Ethereum has the same signers (the diff prints nothing)
E=https://ethereum-rpc.publicnode.com
EO=$(cast call 0xc026395860Db2d07ee33e05fE50ed7bD583189C7 "owner()(address)" --rpc-url $E)
n(){ tr -d '[] ' | tr ',' '\n' | tr A-F a-f | sort; }
diff <(cast call $OS "getSigners()(address[])" --rpc-url $T | n) <(cast call $EO "getSigners()(address[])" --rpc-url $E | n) && echo same signers
# -> same signers

Notes: methodology_test_2026-09-16.md

2. pathUSD on Tempo is administered by one key, with a second key as blacklist admin, and both are EIP-7702 accounts delegating to the same contract

The administrator of pathUSD is a single externally owned account that has been delegated through EIP-7702: its code is a delegation to another contract. No account holds the pause, unpause and burn-blocked roles, so the administrator can grant them to itself and pause or seize in one transaction. The transfer policy is a blacklist administered by a second, distinct single account that can blacklist any holder. Both accounts delegate to the same contract. Whether they share an operator is not established; the note records that as an open point. The composite for pathUSD is 9. Its supply grew by 58 percent in nine days, and the composite does not weight by value.

Replay it (public data, no key)

# the administrator holds the default admin role; its code is an EIP-7702 delegation (0xef0100 followed by the delegate)
T=https://rpc.tempo.xyz
P=0x20c0000000000000000000000000000000000000
ADMIN=0x79C6631FA15CdA38777FB9DD7a6348bAEe794a4E
cast call $P "hasRole(address,bytes32)(bool)" $ADMIN 0x0000000000000000000000000000000000000000000000000000000000000000 --rpc-url $T
cast code $ADMIN --rpc-url $T
# -> true, then 0xef01000000fb7702036ff9f76044a501ac1aa74cbab16b
# the blacklist policy is 2 and its administrator carries the same delegation
cast call $P "transferPolicyId()(uint64)" --rpc-url $T
cast code 0x251d2711ebeB0a09fdB8992F5506f3D949175246 --rpc-url $T
# -> 2, then the same 0xef0100... delegation

Notes: finding_2026-09-26-pathusd-reverified-live.md

3. Morpho Blue on Tempo answers to the same nine owners as Morpho Blue on Ethereum, Base and Robinhood Chain

The owner of the Morpho Blue core on Tempo is a Safe (version 1.4.1) that needs 5 of 9 signatures, with no module and an empty guard slot. Its nine owners are the same nine as the 5-of-9 owners of Morpho Blue on Ethereum, Base and Robinhood Chain: one committee over four chains. The owner powers are narrow (fee capped at 25 percent, no fee recipient set, no way to move user funds or change an existing market) and carry no delay. The market-level price authority, where most of the Morpho price risk sits, is not captured by this score.

Replay it (public data, no key)

# the owner on Tempo: threshold, owners, modules
T=https://rpc.tempo.xyz
OW=$(cast call 0x10EE9AAC980A180dd4DcFc96C746d60B0EA88f97 "owner()(address)" --rpc-url $T)
cast call $OW "getThreshold()(uint256)" --rpc-url $T
cast call $OW "getOwners()(address[])" --rpc-url $T | tr ',' '\n' | wc -l
cast call $OW "getModulesPaginated(address,uint256)(address[],address)" 0x0000000000000000000000000000000000000001 10 --rpc-url $T
# -> 5, then 9, then modules: []
# the same owner set as Morpho Blue on Base (the diff prints nothing)
BASE=https://mainnet.base.org
BO=$(cast call 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb "owner()(address)" --rpc-url $BASE)
n(){ tr -d '[] ' | tr ',' '\n' | tr A-F a-f | sort; }
diff <(cast call $OW "getOwners()(address[])" --rpc-url $T | n) <(cast call $BO "getOwners()(address[])" --rpc-url $BASE | n) && echo same owners
# -> same owners

Notes: scored_targets_2026-09-19-morpho-blue.md

Targets

14 targets are tracked on Tempo, read from mainnet and scored by the oracle on Tempo (Moderato). Bands of the composite score:

Up to 12 targets, ordered by value where known, then by lowest score. Each name opens the contract page.

What is not read

critical	4
weak	4
moderate	5
decent	1

Target	Composite	Band
USDT0	43	moderate
Tempo L1 validator registry (ValidatorConfigV2)	31	weak
Morpho Blue core	55	moderate
Sentora pathUSD (Morpho Vault V2)	27	weak
Tempo Earn (Morpho Vault V2, Gauntlet-curated)	61	decent
pathUSD	9	critical
USDB	9	critical
DLUSD	9	critical
Unnamed pathUSD Vault V2 feeding Sentora	9	critical
cbBTC	39	weak
PRIME	39	weak
cUSD	43	moderate

Read from the public repository and the Watch at build, 2026-10-15 21:09 UTC. A finding is a dated reading with its replay, not an audit and not investment advice. All chain files · Dashboard.