Deployed bytecode matches signed release tag

Evidence summary #

EigenLayer uses a structured release cadence (GitHub releases: v1.6.0, v1.8.1, v1.9.0, v1.12.0 with dates). Audit reports reference specific commit SHAs. No independent bytecode-vs-commit-SHA match verification at assessment tier — gap for curator. Release discipline is above average for the space but not independently confirmed.

Sources #

Methodology #

Determine whether the deployed runtime bytecode corresponds to a signed git tag in the protocol's repository.

See the full factor methodology and distribution across all protocols →