audit-deps

/audit-deps — vet the libraries you import

The bug isn't always in your code — sometimes it's in the version of OpenZeppelin you pinned 18 months ago. This command enumerates every dependency, resolves its real installed version, and checks it against a bundled advisory snapshot.

Procedure

Step 1 — Enumerate imports

Collect the dependency surface from every source of truth:

cat "${CLAUDE_PLUGIN_ROOT}/../remappings.txt" 2>/dev/null
cat package.json 2>/dev/null | node -e 'let p=require("/dev/stdin");console.log(JSON.stringify({...p.dependencies,...p.devDependencies}))'
grep -E 'libs\s*=' foundry.toml

Then sweep actual import statements for what is really referenced:

grep -rhoE 'import .*"(@openzeppelin|solady|solmate|forge-std)[^"]*"' src/ test/ | sort -u

Common families to resolve: @openzeppelin/contracts, @openzeppelin/contracts-upgradeable, solady, solmate, forge-std.

Step 2 — Resolve installed versions

• Git submodules (lib/openzeppelin-contracts): git -C lib/<dep> rev-parse HEAD and git -C lib/<dep> describe --tags for the pinned SHA / tag.
• npm: read the resolved version from node_modules/<pkg>/package.json, not the range in package.json.
• Record exact version per dependency. A floating range (^4.0.0) installed as 4.9.6 is what matters.

Step 3 — Cross-reference advisories

Match each resolved version against the bundled offline advisory snapshot. High-signal historical examples to check:

• OpenZeppelin — ECDSA signature malleability / tryRecover (< 4.7.3), TransparentUpgradeableProxy selector clash (< 4.8.3), Governor castVote / proposal-id collision, Initializable re-init (< 4.8), Multicall + ERC2771 address-spoofing (< 4.9.3).
• Solady — SafeTransferLib returning success for non-contract targets, LibClone immutable-arg edge cases.
• solmate — ERC20.permit deadline / SafeTransferLib no-code-check absence.

Step 4 — Flag drift

• Pragma drift — pinned pragma solidity 0.8.19; in your code vs a floating ^0.8.0 in a dependency (or vice versa). [[pragma-and-addresses]].
• Vendored divergence — code copied into src/vendor/ or src/lib/. Diff it against the upstream tag; flag any line that differs (security fixes silently dropped).