Open Hg347 opened 5 months ago
Other option is to directly switch to ape framework since brownie is no longer maintained.
Btw. Snyk does only analyze dependencies and python code but not vyper code. For vyper static analysis slither could be added to the build pipeline.
Overview
There are vulnerable packages in the pip dependencies that are defined by requirements.txt It should contain:
Since curve deals with a lot of money, there should be a focus on fixing known vulnerabilities quickly. Static code analysis scanners like snyk.io should be used for this purpose.