Dependency manifest uses unpinned versions

Evidence summary #

OpenZeppelin contracts and contracts-upgradeable both pinned at exact version 5.0.2 in package.json with a resolutions override. Chainlink contracts-ccip pinned at exact version 1.6.1. These are the most security-critical dependencies. LayerZero packages use caret (^) range specifiers: @layerzerolabs/lz-evm-protocol-v2: ^3.0.7, @layerzerolabs/oft-evm: ^0.1.0, @layerzerolabs/lz-evm-messagelib-v2: ^3.0.9 — minor/patch versions may float. Per methodology: yellow = minor libs unpinned but OZ and Solady pinned. LayerZero is a significant protocol dependency (though routes are currently paused) but not the core cryptographic primitive that OZ is.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →