Dependency manifest uses unpinned versions

Evidence summary #

Stakenet Cargo.toml: Anchor 0.31.1 (exact pin), Solana SDK 2.3.x (= pinned), SPL Stake Pool 2.0.0 (exact), SPL Token 4.0 (no = prefix — range allowed minor updates). The SPL Token 4.0 range specifier is a minor flexibility in a well-controlled library but technically not fully pinned per methodology. Most critical deps are exactly pinned.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →