Dependency manifest uses unpinned versions
Hyperlane's assessment for RD-F-133 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
All 9 remappings in remappings.txt use fixed version pinning with no wildcards: @openzeppelin/contracts v4.9.3, @openzeppelin/contracts-upgradeable v4.9.3, @arbitrum/nitro-contracts v1.2.1, @chainlink/contracts-ccip v1.5.0, @eth-optimism/contracts v0.6.0, @predicate/ v2.2.2, forge-std/ v1.9.2, ds-test/ v1.9.2, permit2/ v1.0.0. No unpinned critical libraries. Score: green.
Sources #
- GitHubHyperlane Monorepo — solidity/foundry.toml (raw)foundry.toml — solc 0.8.33, optimizer_runs 10000, evm_version cancun; OZ 4.9.3 listed in dependencies sectionretrieved 2026-05-17
- Hyperlane Monorepo — solidity/remappings.txt (raw)remappings.txt — 9 remappings all using fixed version pinning (OZ 4.9.3, forge-std 1.9.2, etc.)retrieved 2026-05-17
Methodology #
Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).
See the full factor methodology and distribution across all protocols →