GitHub malicious-dependency incident touching protocol deps
Jito's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No GitHub Security Advisory (GHSA) flagged against jito-foundation repositories or their Rust dependencies as of 2026-04-29 from available public sources. The August 2024 Agave/Jito rBPF vulnerability (CALL_REG misalignment) was a client-level zero-day, not a supply-chain dependency compromise; patched in 72 hours. jito-solana tracks upstream Agave continuously. data cache: security_md_present=true, changelog_present=true. No malicious-dependency advisory identified.
Sources #
- GitHubJito Foundation Jito-Solana Repositoryjito-foundation/jito-solana — security_md_present=true, changelog_present=true (data cache); active maintenance with no flagged dependency advisoriesretrieved 2026-04-29
- Anza — Agave Network Patch Root Cause AnalysisAnza rBPF vulnerability postmortem: August 2024 CALL_REG bug affected Agave and Jito clients; was a validator client vulnerability, not a supply-chain dependency compromise; patched 2024-08-08retrieved 2026-04-29
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →