Dependency manifest uses unpinned versions
Concrete's assessment for RD-F-133 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
foundry.toml pins OZ at exact version 5.2.0 (no ^ or ~ prefix). Data cache confirms oz_contracts_version='5.2.0'. Critical library (OZ) is pinned to exact version. Green.
Sources #
- GitHub
- 00-data-cache.json github sectionData cache github.oz_contracts_version=5.2.0retrieved 2026-05-17
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol concrete factor RD-F-133 score green collected_at 2026-05-17 14:36:59