Fix-merged-but-not-deployed gap
QuickSwap's assessment for RD-F-140 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
H-01 fix status pre-launch is unclear — sponsor acknowledged but no verifiable on-chain evidence of fix merged and deployed before Oct 7 2022 launch. V2 core is frozen (last commit Dec 2022). No other known fix-merged-but-not-deployed gap identified beyond H-01 ambiguity.
Sources #
- AuditCode4rena H-01 — Fix Status AmbiguousCode4rena report H-01 shows sponsor marked as confirmed with recommendation only — no fix-committed SHA citedretrieved 2026-05-16
- QuickSwap Core — Frozen Post-LaunchQuickSwap core GitHub last commit Dec 2022 — no post-audit fix commits visible in public reporetrieved 2026-05-16
Methodology #
Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol quickswap factor RD-F-140 score yellow collected_at 2026-05-16 08:48:31