Dependency manifest uses unpinned versions

Evidence summary #

All programs use exact version pins in Cargo.toml: anchor-lang = '0.31.0', anchor-spl = '0.31.0', solana-sdk = '2.1.0', bytemuck = '1.20.0' (damm-v2), bytemuck = '1.13.1' (dlmm-sdk). No semver range operators (^, ~) found for security-critical libraries. Cargo.lock pins all transitive dependencies by hash.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →