Dependency manifest uses unpinned versions

Evidence summary #

OpenZeppelin contracts are included as Foundry submodules (lib/openzeppelin-contracts and lib/openzeppelin-contracts-upgradeable confirmed in the Code4rena repo lib directory). Foundry submodules pin at a specific commit SHA when initialized via `forge install`. However, the exact OZ version or pinned SHA is not publicly disclosed (no accessible .gitmodules). Partial evidence of pinning via Foundry convention, but not independently confirmed. Unpinned version cannot be ruled out if `forge update` has been run post-initialization.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →