Dependency manifest uses unpinned versions

Evidence summary #

stableswap-ng pyproject.toml pins Vyper exactly at '0.3.10' (no caret). Python uses ^3.10 (minor-update allowed but not security-critical). titanoboa-zksync pinned to git tag v0.1.2. The security-critical compiler dependency (Vyper) is strictly pinned. No Solidity libraries (OZ, Solady) used.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →