Dependency tree uses EOL Solidity version
Stake DAO's assessment for RD-F-174 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Core contracts use supported versions: vlSDT 0.8.28 (current), Votemarket 0.8.17/0.8.19 (supported), sdCRV 0.8.7 (older but not EOL in same way). CurveYCRVVoter uses Solidity 0.5.17 — this is EOL (Solidity 0.5.x is no longer supported). CurveYCRVVoter holds the primary CRV locker position for the protocol. Yellow: EOL version on a functionally important contract, though the contract is architecturally simple and non-upgradeable.
Sources #
- EtherscanCurveYCRVVoter — EOL Solidity VersionCurveYCRVVoter 0x52f541764E6e90eeBc5c21Ff570De0e2D63766B6 — v0.5.17+commit.d19bba13 (EOL)retrieved 2026-05-16
- vlSDT — Current Solidity VersionvlSDT 0x94818A7baa7e9F5dC62ce4da1B52ef9a760b80B8 — v0.8.28 (current, supported)retrieved 2026-05-16
Methodology #
Determine whether the deployed code or its dependencies use an EOL or unsupported Solidity version without a forward-compatibility patch.
See the full factor methodology and distribution across all protocols →