Dependency manifest uses unpinned versions
Uniswap (v2 + v3)'s assessment for RD-F-133 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Pre-marked not_applicable per combined-slug Cat 8 rule. For record: V3-core package.json has empty production dependencies. UniversalRouter uses unpinned solmate (no commit SHA in .gitmodules) — mitigated by multi-firm audit coverage of UniversalRouter. V2-core: no security-critical npm deps.
Detail #
The Cat 8 pre-mark as not_applicable per profile flag applies. Informational note: UniversalRouter's .gitmodules does not pin commit SHAs for its 5 submodules (forge-std, solmate, permit2, v3-periphery, v4-periphery). The solmate submodule in particular is security-critical in the context of UniversalRouter functionality. This unpinning is mitigated by the multi-firm audit coverage (ABDK, OpenZeppelin, Spearbit) that audited UniversalRouter at specific commits.
Sources #
- Curator noteProfile §5 — both V2 and V3 confirmed as original protocolsProfile §5 + meta.json cat_8_pre_mark: all_not_applicable_both_versionsretrieved 2026-05-12
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →