Fix-merged-but-not-deployed gap

Symbiotic's assessment for RD-F-140 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Immutable core eliminates fix-merged-but-not-deployed gap. Any fix to OperatorRegistry, NetworkRegistry, or DefaultCollateral would require a new contract deployment (not a patch to existing bytecode). No gap between repo and deployed state is possible for the non-upgradeable contracts.

Sources #

Docs
Paradigm — Symbiotic Immutable CoreParadigm blog — immutable core contracts; no upgrade pathwayretrieved 2026-05-16

Methodology #

Determine whether a known vulnerability has a PR merged in the repo but the fix has not been included in the deployed bytecode.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol symbiotic factor RD-F-140 score green collected_at 2026-05-16 09:25:24