GitHub malicious-dependency incident touching protocol deps
Ondo Finance's assessment for RD-F-160 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Threshold: security advisory flagging malicious release in dep consumed by Ondo. OZ contracts version `4.8.3` (from data cache) — no current CVE advisory found for this version targeting Ondo's usage pattern. Chainalysis oracle dependency: no malicious-release advisory found. | green
Sources #
- Curator noteExtracted from 06-realtime-intel.md — RD-F-160 finding; no URL cited in originalretrieved 2026-04-28
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol ondo-finance factor RD-F-160 score gray collected_at 2026-05-14 12:01:55