Dependency manifest uses unpinned versions

Evidence summary #

pyproject.toml pins vyper==0.4.3 (exact — good). snekmate (a security-relevant Vyper library) is specified as snekmate>=0.1.1 (minimum version, not pinned exact). No Foundry .gitmodules found (Vyper project uses Python pip rather than Foundry submodules for production dependencies). Unpinned snekmate allows unexpected minor-version pulls. Threshold: green = all critical libraries pinned exact; yellow = minor libs unpinned but core pinned.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →