GitHub malicious-dependency incident touching protocol deps
StakeWise v3's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
StakeWise v3-core uses Foundry toolchain (foundry.toml confirmed in data cache; no package.json; Solidity 0.8.26). Primary external dependency is OpenZeppelin contracts. No GitHub Security Advisory (GHSA) flagging a malicious release in OpenZeppelin contracts, Solidity 0.8.26 toolchain, or Forge-std in the trailing 90 days identified via web search. No malicious-dependency incident affecting relevant deps detected.
Sources #
- Internal00-data-cache.json sources.github: foundry_toml_present=true, solidity_version=0.8.26, package_json_present=false - dependency manifest identified; OZ is primary depretrieved 2026-05-16
- StakeWise v3-core dependency contextstakewise/v3-core — no GHSA advisory for OZ contracts or Solidity 0.8.26 in trailing 90 daysretrieved 2026-05-16
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol stakewise factor RD-F-160 score green collected_at 2026-05-16 01:03:28