Dependency manifest uses unpinned versions
Beefy Finance's assessment for RD-F-133 — scored not_applicable on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Cat 8 fork-lineage factor; not applicable to original protocols. Factual note: package.json pins @openzeppelin/contracts-upgradeable 4.9.3 (exact), @openzeppelin-4/contracts 4.7.2 (exact), but @openzeppelin-5/contracts is 'latest' (unpinned) — relevant context for any future Cat 8 hygiene expansion.
Sources #
- GitHubbeefy-contracts package.jsonpackage.json — OZ dependencies: upgradeable 4.9.3 (pinned), OZ-5 'latest' (unpinned)retrieved 2026-05-16
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol beefy factor RD-F-133 score not_applicable collected_at 2026-05-16 13:10:30