GitHub malicious-dependency incident touching protocol deps
Symbiotic's assessment for RD-F-160 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
No malicious-dependency security advisory found for Symbiotic's dependencies. Primary dependency is OpenZeppelin Contracts v5.0.2 — a well-maintained, security-advisory-monitored library. No GHSA advisory for OZ v5.0.2 as of 2026-05-16. Foundry.toml dependency pins are present (OZ v5.0.2). No npm or PyPI dependencies at risk.
Sources #
- GitHubSymbiotic core GitHubsymbioticfi/core foundry.toml — OZ v5.0.2 pinned dependencyretrieved 2026-05-16
- Symbiotic profile meta — OZ version.research/protocols/symbiotic/00-profile.meta.json — oz_contracts_version: 5.0.2retrieved 2026-05-16
Methodology #
Determine whether a security advisory flags a malicious release in a dependency consumed by this protocol.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol symbiotic factor RD-F-160 score green collected_at 2026-05-16 09:25:24