Fix-merged-but-not-deployed gap

Liquity V1 + V2 (LUSD / BOLD)'s assessment for RD-F-140 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No fix-merged-but-not-deployed gap. v2 launched from fully-audited codebase. Immutable post-launch — no fixes can be merged-but-not-deployed into an immutable contract. v1 has been immutable since 2021 with no known unfixed vulnerabilities in deployed code.

Sources #

Docs
Liquity v2 Technical Docs and AuditsLiquity v2 technical docs and audits — comprehensive audit coverage before relaunchretrieved 2026-05-16

Methodology #

Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol liquity factor RD-F-140 score green collected_at 2026-05-16 10:35:50