Dependency manifest uses unpinned versions

Evidence summary #

centrifuge/protocol repo uses Foundry with soldeer for dependency management. foundry.toml shows auto_detect_remappings = false and specific lib paths. soldeer.lock file not found at root (404) suggesting it may be elsewhere or dependencies pinned via git submodule SHAs. No npm-style unpinned dependencies found in smart contract repos. Marking yellow for incomplete evidence.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →