GitHub malicious-dependency incident touching protocol deps
Aerodrome Finance's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Cat 11: GitHub malicious-dependency incident touching protocol deps. OZ v4.8.0 confirmed (data cache oz_contracts_version). No active GHSA malicious-release advisory for OZ 4.8.0 as of 2026-05-04. Foundry-based build (foundry_toml_present: true per data cache). OZ 4.8.0 is a well-established version without known malicious-release history. No active advisory affecting Aerodrome's known dependency set based on public GHSA search.
Sources #
- URLAerodrome Finance Contracts GitHubData cache: oz_contracts_version: '4.8.0'; foundry_toml_present: true; no malicious-release advisory found in public GHSA for OZ 4.8.0retrieved 2026-05-04
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →