Dependency manifest uses unpinned versions
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score#
What this measures
This factor detects whether the protocol's package manifest files -- package.json, Cargo.toml, foundry.toml, or equivalent -- use range specifiers (^ or ~) for security-critical library dependencies such as OpenZeppelin Contracts, Solady, or Solmate, rather than exact pinned version strings. Unpinned dependencies allow npm or package managers to silently update the library to a newer version on the next install, potentially introducing a newly-published vulnerability or a supply-chain-compromised release. The data source is the protocol's public repository.
Why it matters
Unpinned critical library dependencies are a supply-chain attack surface. If an attacker compromises an npm package for OpenZeppelin at version 4.9.4 (hypothetically), all protocols using ^4.9.0 or ~4.9.0 in their package.json will pull the malicious version on their next npm install -- including CI/CD pipelines building the deployment artifact. Even without a malicious release, auto-updating to a library version with a newly-discovered bug can introduce a vulnerability that was not present in the previously pinned version. Approximately two documented instances in the T-01 inventory involve library dependency incidents.
Green / Yellow / Red
Green: all security-critical library dependencies (OpenZeppelin, Solady, Solmate, or equivalents) are pinned to exact version strings (no ^ or ~ prefix) in all package manifest files, and lock files are committed. Yellow: non-security-critical development dependencies use range specifiers, but all deployed contract libraries are pinned. Red: any range specifier is used for OpenZeppelin, Solady, or equivalent libraries that are compiled into the deployed bytecode.
Common gray cases
This factor is gray when the protocol does not use a package manager (e.g., vendored or inline library copies) or when the repository is private and the manifest cannot be inspected.
Notable historical examples
No hacks are currently linked in the database for this specific factor as a standalone causal driver. The factor is retained as P1 based on its supply-chain risk classification in the T-01 evidence inventory.
Measurement what to look for#
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).