Fix-merged-but-not-deployed gap
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score#
What this measures
This factor identifies whether a known vulnerability exists in the deployed codebase — confirmed via a PR merged in the public repository — but the fix has not been included in the currently deployed bytecode. This gap between a merged fix and a deployed fix is the "fix-merged-but-not-deployed" state: the team acknowledged the vulnerability and prepared a patch, but users' funds remain at risk from the unpatched deployed code.
Why it matters
Mirror Protocol and the Venus REKT4 incident both exemplify this failure mode: a governance proposal to fix a known vulnerability was created and merged, but the production deployment lagged behind the repository state. The Deus DAO 2 exploit demonstrated the urgency particularly clearly — the attacker's bypass of a post-hack oracle fix came 40 days after the fix was deployed, but the window between the first fix being described and the second vector being closed was entirely preventable. A fix-merged-but-not-deployed gap means users are exposed to a vulnerability the team knows about and has solved — the only remaining question is when the attacker will find it.
Green / Yellow / Red
Green is assigned when the deployed bytecode is current with the repository's main branch and no known vulnerabilities have open PRs without corresponding deployments. Yellow covers cases where a low-severity fix has been merged but not yet deployed, with a documented deployment timeline. Red is assigned when a high or critical severity fix has been merged into the repository but the corresponding upgrade has not been applied to the production deployment.
Common gray cases
This factor is grayed when the protocol repository is private or when the PRs cannot be matched to specific bytecode changes within the assessment window.
Notable historical examples
No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for#
Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.