Shared-library version with known-vuln status
A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor records the specific version numbers of key shared libraries used in the protocol's deployed contracts -- primarily OpenZeppelin Contracts, Solady, and Solmate -- and checks whether those versions carry any current CVE or public security advisory. The data source is the protocol's repository (package lock or import paths) combined with the CVE database and GitHub Security Advisories for the relevant library packages.
**Why it matters** Shared libraries are a systemic risk amplifier: a bug in a widely-used library version affects every protocol that has deployed that version, simultaneously. The Curve/Vyper compiler bug ($69M across four protocols simultaneously, July 2023) is the most dramatic example in the dataset -- all four affected protocols used the same Vyper compiler version (0.2.15-0.3.0) with the reentrancy guard bug. A depositor-facing dashboard that can identify 'this protocol uses library version X, and a CVE was published for version X last week' provides actionable advance warning before an exploit occurs. The 90-day gap between the publication of a library CVE and the first documented exploit in that class is a common pattern.
**Green / Yellow / Red** Green: all shared libraries are at versions with no current CVE or public advisory, or the protocol has deployed a patch addressing any known advisory. Yellow: a library advisory exists but the advisory severity is medium or low, and the specific vulnerable code path is not exercised by the protocol's usage pattern (confirmed by curator review). Red: a library used in deployed contracts has an active high or critical CVE with no patch deployed.
**Common gray cases** This factor is gray when library version cannot be determined from the repository (vendored inline copies without version metadata) or when the library is proprietary with no public advisory channel.
**Notable historical examples** The Curve/Vyper compiler incident ($69M, 2023) is the closest motivating case, though it involves RD-F-170 (compiler version) rather than shared library version specifically.
Measurement what to look for #
Identify the version of key shared libraries (OZ, Solady, Solmate) used and check against CVE/GHSA databases for any active advisory.