Dependency manifest uses unpinned versions

Evidence summary #

vlSDT package.json specifies @openzeppelin/contracts: '5.2.0' — exact version pin (no ^ or ~ semver range). foundry-base-config.toml specifies solc = '0.8.28' exactly. Good dependency pinning discipline visible in the vlSDT package. Note: this factor applies to this original protocol's own dependencies, not to an upstream fork relationship.

Sources #

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →