Dependency manifest uses unpinned versions

Fluid's assessment for RD-F-133 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

package.json pins @openzeppelin/contracts at exactly '4.8.2' and solmate at '6.2.0'. No ^ or ~ on critical security libraries. Only development utilities use tilde specifiers.

Sources #

GitHub
Fluid Contracts package.jsonpackage.json — OZ 4.8.2, solmate 6.2.0 exactly pinnedretrieved 2026-04-29

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol fluid factor RD-F-133 score green collected_at 2026-04-29 10:35:01