Fix-merged-but-not-deployed gap
A post-deploy hygiene & change mgmt factor in the v1.7.0 rubric. Measured per protocol on a e cadence.
Methodology how we score #
**What this measures** This factor identifies whether a known vulnerability exists in the deployed codebase — confirmed via a PR merged in the public repository — but the fix has not been included in the currently deployed bytecode. This gap between a merged fix and a deployed fix is the "fix-merged-but-not-deployed" state: the team acknowledged the vulnerability and prepared a patch, but users' funds remain at risk from the unpatched deployed code.
**Why it matters** Mirror Protocol and the Venus REKT4 incident both exemplify this failure mode: a governance proposal to fix a known vulnerability was created and merged, but the production deployment lagged behind the repository state. The Deus DAO 2 exploit demonstrated the urgency particularly clearly — the attacker's bypass of a post-hack oracle fix came 40 days after the fix was deployed, but the window between the first fix being described and the second vector being closed was entirely preventable. A fix-merged-but-not-deployed gap means users are exposed to a vulnerability the team knows about and has solved — the only remaining question is when the attacker will find it.
**Green / Yellow / Red** Green is assigned when the deployed bytecode is current with the repository's main branch and no known vulnerabilities have open PRs without corresponding deployments. Yellow covers cases where a low-severity fix has been merged but not yet deployed, with a documented deployment timeline. Red is assigned when a high or critical severity fix has been merged into the repository but the corresponding upgrade has not been applied to the production deployment.
**Common gray cases** This factor is grayed when the protocol repository is private or when the PRs cannot be matched to specific bytecode changes within the assessment window.
**Notable historical examples** No cross-hacked incidents currently linked in database for this factor.
Measurement what to look for #
Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.