GitHub malicious-dependency incident touching protocol deps
SUNSwap (sun.io)'s assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No malicious-dependency advisory flagging sun-protocol deps detected as of 2026-05-17. V4 uses Solidity 0.8.26 with hardhat/foundry; V2/V3 use OZ 3.4.1-solc-0.7-era; sun-dao-contracts use Vyper. No GitHub Security Advisory for sunswap-v4-core or sun-dao-contracts found in available public sources. Low-to-medium confidence — requires GitHub API advisory subscription for production monitoring.
Sources #
- URLGitHub - sun-protocol organisationGitHub sun-protocol organisation — no advisory alerts visibleretrieved 2026-05-17
- SUNSwap profile - dependency versions.research/protocols/sunswap/00-profile.md §5 dependency versions OZ 3.4.1-solc-0.7-era V2/V3; Solidity 0.8.26 V4retrieved 2026-05-17
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol sunswap factor RD-F-160 score green collected_at 2026-05-17 14:37:31