Dependency manifest uses unpinned versions
deBridge's assessment for RD-F-133 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
`debridge-contracts-v1/package.json`: `"@openzeppelin/contracts": "^4.3.2"` and `"@openzeppelin/contracts-upgradeable": "^4.3.2"` — both use caret ranges (semi-unpinned). `dln-contracts/package.json`: `"@openzeppelin/contracts-upgradeable": "^4.7.3"` — also caret-ranged. Caret allows minor/patch updates within major version, which is generally acceptable for OZ but technically unpinned. The deployed bytecode (Etherscan-verified) shows compiled artifacts, so the caret range is only a concern f...
Sources #
- GitHubhttps://github.com/debridge-finance/debridge-contracts-v1/blob/main/package.jsonretrieved 2026-04-28
- https://github.com/debridge-finance/dln-contracts/blob/main/package.jsonretrieved 2026-04-28
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →