Dependency had malicious-release incident (last 90d)
Convex Finance's assessment for RD-F-134 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No GitHub Security Advisory or npm security bulletin found affecting @openzeppelin/contracts 3.4.0 (the primary security-critical dependency) in the last 90 days. Truffle and chai (dev-only, caret-ranged) have no malicious release advisories affecting the pinned versions in use.
Sources #
- GitHubConvex platform package.json (OZ 3.4.0 pinned, no malicious-release advisory found)package.json - pinned depsretrieved 2026-05-16
- GitHub Security Advisories for @openzeppelin/contracts (no active advisory for 3.4.0 in 90 days)GitHub Advisory Database - OZ 3.4.0retrieved 2026-05-16
Methodology #
Determine whether any npm/PyPI/crates.io dependency of this protocol had a flagged malicious release in the trailing 90 days.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol convex-finance factor RD-F-134 score green collected_at 2026-05-16 02:41:28