Dependency manifest uses unpinned versions
Balancer (v2 + v3)'s assessment for RD-F-133 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
This factor applies to library dependencies even for original protocols. v3 package.json uses '@openzeppelin/contracts': '~5.4.0' (tilde = patch-only updates, relatively strict) and '@openzeppelin/contracts-upgradeable': '^4.9.6' (caret = minor+patch updates, less strict). The caret on upgradeable contracts is less strict than ideal for security-critical dependencies. v2 vendored OZ locally in v2-solidity-utils — eliminates npm dependency risk for v2 OZ. Mixed strategy is yellow: v3 caret on upgradeable OZ is the risk item.
Sources #
- GitHubv3 package.json: OZ ~5.4.0 (tilde), upgradeable ^4.9.6 (caret)https://github.com/balancer/balancer-v3-monorepo/blob/main/package.jsonretrieved 2026-05-05
- v2 solidity-utils: vendored OZ SafeMath availablehttps://github.com/balancer/balancer-v2-monorepo/tree/master/pkg/solidity-utilsretrieved 2026-05-05
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →