StakeStone

QuantstampRepository at commit d34a1ec

Audit

Quantstamp reviewed StakeStone on 25 Jul 2024: 11 findings, 0 critical; 5 marked fixed, 5 acknowledged, 1 open.

No open critical findings
Open the reportOpen StakeStone’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium102
Low053
MediumMissing Enforcements for VotingOpen

The current voting implementation faces the following issues: 1. **There is no minimum number of votes needed to reach quorum.** The `canExec()` function returns `detail.support > detail.oppose`. The percentage of token holders participating in the proposal is not taken into account. A proposal with a single vote in favor (and no votes opposing) would be executed, possibly against the will of all of the other token holders. 2. **There is no upper-bound on the `votingPeriod`.** The default locking period is 7 days. However, the locking period can be reassigned with no upper bound by the `SET_PARAM_ROLE`. An excessive locking period could dissuade voting, delay proposal executions, or lock user's STONE for excessively long periods. 3. **Users may be unable to vote when there are multiple proposals.** Users gain voting power by staking their STONE on a specific proposal. STONE can only be staked on a single proposal at a time. If there are multiple active proposals, a user will have to split their votes between them. The StakeStone team has indicated that they will only have one active proposal at a time. However, this is not enforced in the smart contract. 4. **Users cannot change their votes.** If a user votes on a proposal, they are unable to withdraw their tokens until the proposal deadline has been reached. This makes them unable to change their vote. With a default of a 7-day locking period, a user may be presented with new information that could sway their vote.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (36)

  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/NativeLendingETHStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IWstETH.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/token/L2Stone.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/scripts/deployMainnetCrossChain.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/governance/Proposal.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/Strategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/token/Stone.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/StrategyV2.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IDelegationManager.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/truffle-config.template.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ILidoWithdrawalQueue.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/test/testCarnival.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/SymbioticDepositWstETHStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/StrategyController.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/scripts/deploymentOnMainnet.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/SwappingAggregator.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/eigen/Account.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IWETH9.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IEigenStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/package.json at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ICollateral.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IAquaLpToken.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/scripts/deployment.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/token/StoneOFT.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/AssetsVault.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/eigen/EigenLSTRestaking.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IDelayedWithdrawalRouter.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/scripts/deployLZToken.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ILido.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IStrategyManager.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IStableSwap.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/scripts/deploymentOnForkedMainnet.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/token/Minter.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/libraries/VaultMath.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/StoneVault.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
  • https://github.com/stakestone/stone-vault-v1/contracts/strategies/EigenStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b

Part of StakeStone’s security record

StakeStone
Audits4 audits by 1 firmLast audit Oct 2025, by Quantstamp.
Critical findingsNo open critical findingsAcross 4 reports.
Open StakeStone’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us