Fix-merged-but-not-deployed gap
Beefy Finance's assessment for RD-F-140 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No specific instance of a fix merged but not deployed identified. However, given volume of deployments and lack of formal release-tag-to-bytecode tracking across thousands of contracts, this cannot be ruled out. Would require diffing deployed bytecode across all vault/strategy instances against latest GitHub commit.
Sources #
- GitHubBeefy Contracts GitHub Repositorybeefyfinance/beefy-contracts — no formal release tagging process identified that would surface fix-merged-not-deployed gapsretrieved 2026-05-16
Methodology #
Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol beefy factor RD-F-140 score gray collected_at 2026-05-16 13:10:30