Dependency manifest uses unpinned versions
EigenLayer's assessment for RD-F-133 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
EigenLayer's .gitmodules lists openzeppelin-contracts-v4.9.0 and openzeppelin-contracts-upgradeable-v4.9.0 as named submodules with version encoded in the path name. However, no explicit commit SHA is pinned for any submodule (OZ, ds-test, forge-std, zeus-templates). The OZ version is anchored by path naming convention only — not cryptographic SHA pinning. This is a mild dependency management gap applicable even to original protocols.
Sources #
- GitHubEigenLayer .gitmodules — dependency pinningLayr-Labs/eigenlayer-contracts .gitmodules — no SHA pins on submodulesretrieved 2026-04-28
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →