Dependency manifest uses unpinned versions

Evidence summary #

package.json pins @openzeppelin/contracts at '4.9.3' (exact, no caret). Chainlink Contracts pinned at '1.1.0' (exact). PRB Math pinned at '2.4.3' (exact). Hardhat uses ^2.26.1 but is a dev tool not deployed. forge-std submodule is dev-only. OZ and Chainlink - the security-critical deployed libraries - are exact-version pinned.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →