Dependency manifest uses unpinned versions

Evidence summary #

Bridge2.sol imports OpenZeppelin contracts but the hyperliquid-dex/contracts repo contains no foundry.toml, package.json, or package-lock.json (data-cache foundry_toml_present: false, package_json_present: false). The specific OZ version pinned cannot be determined without a manifest file. Dependency management may be handled non-standardly.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →