Dependency manifest uses unpinned versions

Evidence summary #

All critical dependencies are pinned to exact versions: `@openzeppelin/contracts: "5.5.0"`, `@openzeppelin/contracts-upgradeable: "5.5.0"`, `@openzeppelin/contracts-v4: "npm:@openzeppelin/contracts@4.9.6"`, `@openzeppelin/contracts-upgradeable-v4: "npm:@openzeppelin/contracts-upgradeable@4.9.6"`. No caret (^) or tilde (~) operators on OpenZeppelin or major security-critical libraries. Exact pinning confirmed from package.json as of the assessment date.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →