Fix-merged-but-not-deployed gap
Sushi (SushiSwap) — v2 + v3 + Trident + BentoBox/Kashi + SushiXSwap's assessment for RD-F-140 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No specific instance of fix merged to repo but not deployed found in current evidence. V2/V3 core contracts are immutable. RouteProcessor series uses new contract deployments (not proxy upgrades), so fix-merged-but-not-deployed gap is structurally less applicable to this pattern.
Sources #
- Internal00-profile.md §3Profile §3 — core contracts immutable; RouteProcessor pattern is full replacement, not upgraderetrieved 2026-05-17
Methodology #
Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol sushi factor RD-F-140 score green collected_at 2026-05-16 19:50:37