Dependency manifest uses unpinned versions
Yearn Finance's assessment for RD-F-133 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
yearn-vaults-v3 package.json pins OpenZeppelin as '^4.9.5' — caret range allowing minor/patch updates (4.9.6, 4.10.x) but pinning to major version 4. OZ is a security-critical library. Caret is not exact-version pinning. foundry.toml uses path-based remapping without inline version specification. Graded yellow: OZ is semi-pinned (major version constrained) rather than fully unpinned, but not at the exact-version pinning that the factor specifies as green.
Sources #
- GitHubyearn-vaults-v3 package.json — OZ caret-pinned at ^4.9.5yearn-vaults-v3 package.json — @openzeppelin/contracts: ^4.9.5retrieved 2026-05-16
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →