GitHub malicious-dependency incident touching protocol deps
Frax Finance's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No GitHub security advisory (GHSA) or equivalent flagging a malicious release in key Frax dependencies in trailing 90d. Key dependencies: OpenZeppelin v5.0.1, OP Stack (Optimism), LayerZero OApp standard, Foundry. No malicious npm/PyPI release in Frax dependency tree reported in public advisory feeds as of 2026-05-17. Note: if a malicious release were found in OZ v5.0.1, OP Stack, or LayerZero OApp within trailing 90d, this factor would flip to red.
Sources #
- GitHubFraxFinance/frax-solidity — dependency manifestFraxFinance/frax-solidity — OZ v5.0.1 dependency; no GHSA advisory for OZ v5.0.1 in trailing 90dretrieved 2026-05-17
- GitHub Security Advisories databaseNo malicious dependency advisory for OZ v5.0.1 or LayerZero OApp in GitHub advisory database as of 2026-05-17retrieved 2026-05-17
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →