A collective DAO designed to unlock liquidity, DeFi and higher rewards for restaked assets through liquid restaking.
Platform: Code4rena
Start Date: 10/11/2023
End Date: 15/11/2023
Period: 5 days
Status: Completed
Pot Size: $28,000 USDC
Participants: 185
Reporter: liveactionllama
Judge: 0xDjango
Id: 305
League: ETH
m_Rassska | 1/185 | $1,250.90 | 3 | 2 | 0 | 0 | 0 | Grade A | 0 | 0 |
CatsSecurity | 2/185 | $1,091.39 | 4 | 2 | 0 | 0 | 0 | - | 0 | - |
adriro | 3/185 | $1,086.27 | 5 | 3 | 0 | 1 | 0 | Grade B | 0 | 0 |
Bauchibred | 4/185 | $1,079.87 | 4 | 1 | 0 | 1 | 0 | Grade B | 0 | Grade A |
PENGUN | 5/185 | $1,045.58 | 3 | 1 | 0 | 1 | 0 | Grade B | 0 | 0 |
SBSecurity | 6/185 | $1,044.54 | 5 | 3 | 0 | 0 | 0 | - | 0 | - |
0xDING99YA | 7/185 | $983.25 | 3 | 2 | 0 | 1 | 0 | 0 | 0 | 0 |
deth | 8/185 | $983.25 | 3 | 2 | 0 | 1 | 0 | 0 | 0 | 0 |
jayfromthe13th | 9/185 | $978.59 | 2 | 1 | 0 | 1 | 0 | 0 | 0 | 0 |
Aamir | 10/185 | $946.02 | 4 | 3 | 0 | 0 | 0 | Grade B | 0 | 0 |
Auditor per page
The 4naly3er report can be found here.
Automated findings output for the audit can be found here within 24 hours of audit opening.
Note for C4 wardens: Anything included in this Automated Findings / Publicly Known Issues section is considered a publicly known issue and is ineligible for awards.
Stader Labs has created new contracts for its upcoming Kelp product. The scope of the audit is to review the contracts and ensure that they are secure, resilient, and working as intended.
LRTConfig: An upgradeable contract which is responsible for storing the configuration of the Kelp product. It is also responsible for storing the addresses of the other contracts in the Kelp product.
LRTDepositPool: An upgradeable contract which receives the funds deposited by users into the Kelp product. From here, the funds are transferred to NodeDelegators contracts.
NodeDelegator: These are contracts that receive funds from the LRDepositPool and delegate them to the EigenLayer strategy. The funds are then used to provide liquidity on the EigenLayer protocol. It is also an upgradeable contract.
LRTOracle: An upgradeable contract which is responsible for fetching the price of Liquid Stasking Tokens tokens from oracle services.
RSETH: Receipt token for depositing into the Kelp product. It is an upgradeable ERC20 token contract.
Also see our blog for additional info
See Linktree
| Contract | SLOC | Purpose | Libraries used |
|---|---|---|---|
| LRTConfig | 111 | Configuration contract | |
| LRTDepositPool | 97 | User interfacing contract when funds are deposited | |
| NodeDelegator | 65 | Recipient of funds from LRTDepositPool. In turn, it sends funds to Eigenlayer strategies | |
| LRTOracle | 60 | get prices of liquid staking tokens | |
| RSETH | 45 | receipt token user receives upon depositing in LRTDepositPool | |
| RSETH | 45 | receipt token user receives upon depositing in LRTDepositPool | |
| ChainlinkPriceOracle | 25 | wrapper contract to integrate chainlink oracles in LRTOracle | |
| LRTConfigRoleChecker | 33 | Handles role checks | |
| UtilLib | 7 | Helper function lib | |
| LRTConstants | 10 | shared constant variables |
It also includes the inherited interface contracts.
| Dependency / Import Path | Count |
|---|---|
| @openzeppelin/contracts-upgradeable/access/AccessControlUpgradeable.sol | 2 |
| @openzeppelin/contracts-upgradeable/proxy/utils/Initializable.sol | 1 |
| @openzeppelin/contracts-upgradeable/token/ERC20/ERC20Upgradeable.sol | 1 |
| @openzeppelin/contracts-upgradeable/utils/PausableUpgradeable.sol | 4 |
| @openzeppelin/contracts-upgradeable/utils/ReentrancyGuardUpgradeable.sol | 2 |
| @openzeppelin/contracts/access/IAccessControl.sol | 1 |
| @openzeppelin/contracts/interfaces/IERC20.sol | 3 |
| @openzeppelin/contracts/token/ERC20/IERC20.sol | 2 |
We are aware that EigenLayer has an mechanism to pause deposits in its protocol. Hence we created a layer called NodeDelegator which holds assets and deposits them into EigenLayer asset strategy. The intention is for these NodeDelegator contracts to deposit into Eigenlayer once deposit is available.
- If you have a public code repo, please share it here: - How many contracts are in scope?: 17 - Total SLoC for these contracts?: 504 - How many external imports are there?: 1 - How many separate interfaces and struct definitions are there for the contracts within scope?: 8 - Does most of your code generally use composition or inheritance?: Inheritance - How many external calls?: 2 - What is the overall line coverage percentage provided by your tests?: 98 - Is this an upgrade of an existing system?: False - Check all that apply (e.g. timelock, NFT, AMM, ERC20, rollups, etc.): ERC-20 Token - Is there a need to understand a separate part of the codebase / get context in order to audit this part of the protocol?: True - Please describe required context: Funds are eventually deposited into EigenLayer strategy and we are using Chainlink price oracles for fetching LST prices - Does it use an oracle?: Chainlink - Describe any novel or unique curve logic or mathematical models your code uses: N/A - Is this either a fork of or an alternate implementation of another project?: False
$ forge test
Get a gas report:
$ forge test --gas-report
Compile the contracts:
$ forge build
Get a test coverage report:
$ forge coverage --report lcov && lcov --remove lcov.info -o lcov.info 'test/*' 'script/*'