Dependency manifest uses unpinned versions

Usual (USD0 / bUSD0 / USUAL)'s assessment for RD-F-133 — scored gray on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

Cannot verify dependency pinning. Private 'pegasus' repo means foundry.toml and package.json are inaccessible. OZ Upgradeable and LayerZero V2 are confirmed dependencies but pinned version and semver-range cannot be confirmed.

Sources #

GitHub
usual-dao GitHub Organizationusual-dao GitHub org — pegasus repo privateretrieved 2026-05-17
Internal
00-profile.md §5 upstream dependenciesProfile §5 — OZ and LayerZero V2 as first-party dependenciesretrieved 2026-05-17

Methodology #

Determine whether `package.json`, `Cargo.toml`, or `foundry.toml` uses `^` or `~` version ranges for security-critical libraries (OpenZeppelin, Solady, etc.).

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol usual factor RD-F-133 score gray collected_at 2026-05-16 20:39:44