Dependency manifest uses unpinned versions

Evidence summary #

platform/contracts/package.json pins OpenZeppelin contracts at exact version 3.4.0 (no caret or tilde). This is the security-critical library. Development-only dependencies (Truffle, chai, hdwallet-provider) use caret ranges but these are not production security-critical. OZ being pinned exactly is the critical finding — green.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →