Dependency manifest uses unpinned versions

Evidence summary #

package.json pins @openzeppelin/contracts at exact version '4.8.3' (no caret or tilde). Security-critical library is exact-pinned. Dev tooling (hardhat ^2.22.17, ethers ^5.7.2) uses ^ ranges which is standard practice for non-deployed build tooling.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →