Dependency manifest uses unpinned versions
Circle USYC's assessment for RD-F-133 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No public GitHub repo for USYC contracts (circlefin org has 87 repos, none USYC-specific). Data cache confirms github.repo_url null and foundry_toml_present false. The Cat 8 framing for this factor is fork-lineage dependency pinning; USYC is an original protocol with no public repo, making the factor not applicable in the fork-lineage sense.
Sources #
- Internalcircle-usyc data cache00-data-cache.json github.repo_url: null, foundry_toml_present: falseretrieved 2026-05-15
- circlefin GitHub Organizationgithub.com/circlefin org — 87 public repos, no USYC-specific contract repo foundretrieved 2026-05-16
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol circle-usyc factor RD-F-133 score not_applicable collected_at 2026-05-15 21:56:43