Dependency manifest uses unpinned versions
Save (formerly Solend)'s assessment for RD-F-133 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
The Cargo.toml for the token-lending program pins ALL dependencies to exact versions: solana-program=1.7.12, spl-token=local path, switchboard-program=0.1.45, arrayref=0.3.6, etc. No ^ or ~ range specifiers found. All pinned to exact versions as of last confirmed update (Nov 2021).
Sources #
- GitHubCargo.toml — solendprotocol/solana-program-librarytoken-lending/program/Cargo.toml — all deps pinned to exact versionsretrieved 2026-05-17
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol save factor RD-F-133 score green collected_at 2026-05-17 15:20:15