GitHub malicious-dependency incident touching protocol deps
Dolomite's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Dolomite uses OpenZeppelin 2.5.1 (data cache github.oz_contracts_version). OZ 2.5.1 is an older version (circa 2020) but has no active malicious-release incident in current GitHub security advisories as of 2026-05-16. The dolomite-margin-modules repo uses more recent dependencies. No GitHub security advisory flagging a malicious release in Dolomite's dependency tree found in public sources. Green — no current malicious-dependency incident detected.
Sources #
- GitHubdolomite-exchange/dolomite-margin GitHub Repositorydolomite-exchange/dolomite-margin: GitHub security advisories — no active malicious-dependency alert foundretrieved 2026-05-16
- Dolomite data cache 00-data-cache.jsondata-cache github.oz_contracts_version: 2.5.1 — no active malicious release advisoryretrieved 2026-05-16
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →