Shared-library version with known-vuln status

Evidence summary #

OZ 4.8.0 has active GHSA advisories: (1) CVE-2023-40014 (ERC2771Context + short calldata, GHSA-g4vp-m682-qqmp, medium severity, affects 4.0–4.9.2, fixed in 4.9.3); (2) GHSA-93hq-5wgc-jc82 (GovernorCompatibilityBravo calldata trimming, moderate, affects 4.3–4.8.2, fixed in 4.8.3); (3) CVE-2023-30541 (TransparentUpgradeableProxy selector clash, affects 3.2–4.8.2, fixed in 4.8.3). No high/critical severity advisory for OZ 4.8.0. Yellow (medium-severity advisories exist; none directly exploitable in Aerodrome's specific OZ usage pattern for AMM).

Sources #

Methodology #

Identify the version of key shared libraries (OZ, Solady, Solmate) used and check against CVE/GHSA databases for any active advisory.

See the full factor methodology and distribution across all protocols →