GitHub malicious-dependency incident touching protocol deps
Ethena's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Ethena uses OpenZeppelin Contracts (ERC-20, ERC-4626, AccessControl) and LayerZero OFT standard. No active GHSA or security advisory against the OZ versions in use (Solidity v0.8.19-0.8.20 era). No npm supply-chain advisories against ethena-labs packages detected in GitHub advisory feeds. LayerZero protocol itself is not subject to a malicious-release advisory (the KelpDAO exploit was an infrastructure/configuration compromise, not a malicious npm release).
Sources #
- GitHubEthena Labs GitHub Orgethena-labs GitHub org — OZ dependency usage, no active GHSAretrieved 2026-04-28
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →