Dependency manifest uses unpinned versions
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor detects whether the protocol's package manifest files -- package.json, Cargo.toml, foundry.toml, or equivalent -- use range specifiers (^ or ~) for security-critical library dependencies such as OpenZeppelin Contracts, Solady, or Solmate, rather than exact pinned version strings. Unpinned dependencies allow npm or package managers to silently update the library to a newer version on the next install, potentially introducing a newly-published vulnerability or a supply-chain-compromised release. The data source is the protocol's public repository.
**Why it matters** Unpinned critical library dependencies are a supply-chain attack surface. If an attacker compromises an npm package for OpenZeppelin at version 4.9.4 (hypothetically), all protocols using ^4.9.0 or ~4.9.0 in their package.json will pull the malicious version on their next npm install -- including CI/CD pipelines building the deployment artifact. Even without a malicious release, auto-updating to a library version with a newly-discovered bug can introduce a vulnerability that was not present in the previously pinned version. Approximately two documented instances in the T-01 inventory involve library dependency incidents.
**Green / Yellow / Red** Green: all security-critical library dependencies (OpenZeppelin, Solady, Solmate, or equivalents) are pinned to exact version strings (no ^ or ~ prefix) in all package manifest files, and lock files are committed. Yellow: non-security-critical development dependencies use range specifiers, but all deployed contract libraries are pinned. Red: any range specifier is used for OpenZeppelin, Solady, or equivalent libraries that are compiled into the deployed bytecode.
**Common gray cases** This factor is gray when the protocol does not use a package manager (e.g., vendored or inline library copies) or when the repository is private and the manifest cannot be inspected.
Measurement what to look for #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).