Dependency manifest uses unpinned versions

Lido's assessment for RD-F-133 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

forge-std submodule in .gitmodules lacks pinned commit SHA (test tooling dependency, low production risk). OZ production libraries pinned exactly in package.json: @openzeppelin/contracts@3.4.0, @openzeppelin/contracts-v4.4@4.4.1, @openzeppelin/contracts-v5.2@5.2.0. Security-critical production libs are pinned; test tooling is not.

Sources #

URL
package.jsonhttps://github.com/lidofinance/core/blob/master/package.jsonretrieved 2026-04-28
URL
.gitmoduleshttps://github.com/lidofinance/core/blob/master/.gitmodulesretrieved 2026-04-28

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol lido factor RD-F-133 score yellow collected_at 2026-04-28 13:58:42