How Does the Audit Process Handle Vulnerabilities Found in External Libraries?

The audit process must address vulnerabilities found in external, non-audited libraries that the smart contract relies on, such as OpenZeppelin or other DeFi protocols. If the vulnerability is in the external library, the auditor must flag the contract's reliance as a critical risk, even if the contract's own code is flawless.

The recommendation is usually to wait for the external library to be patched or to use a verified, well-known version. The audit report typically includes a section detailing these "external dependencies and assumptions."