StakeStone

Quantstamp25 Jul 2024Repository at commit d34a1ec

Audit

Quantstamp reviewed StakeStone on 25 Jul 2024: 11 findings, 0 critical; 5 marked fixed, 5 acknowledged, 1 open.

No open critical findings

Open the report Open StakeStone’s security record

Report hosted on certificate.quantstamp.com.

Trustblock does not review code.

Findings11

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	1	0	2
Low	0	5	3

Low`notAtSameBlock` Modifier May Be BypassedAcknowledged

The `notAtSameBlock` modifier can be bypassed or is missing for the following functions: 1. For `deposit()`, the modifier can be bypassed through calls to the payable `receive()` function. 2. For `withdraw()` and `instantWithdraw()`, the modifier can be passed through calls to the `clear()` function. 3. In `EigenLSTRestaking`, the `instantWithdraw()` function is not protected by the `notAtSameBlock` modifier, allowing multiple withdrawals and deposits within the same block, which in all other strategies is otherwise the case.

LowCentralization of PowerAcknowledged

While it is expected that some privileged roles are needed to operate the protocol, some of the roles can override the powers of the governance and what has been approved by voters. 1. The `REVOKE_ROLE` can revoke a proposal at any time by calling `revokePeoposal()`, allowing them to reject a proposal even when it has been approved by the voters and reached its deadline. 2. While the function `addStrategy()` may only be added via successfully voted proposals, the contract owner may overturn any such added strategies by calling `clearStrategy()` and/or `destroyStrategy()`. 3. The voters are dependent on the `EXECUTOR_ROLE` executing any approved proposals. Should the `EXECUTOR_ROLE` become absent or compromised, the voters would not be able to enact proposals.

LowMissing Comparison with Last PriceAcknowledged

The function `_depositFor()` compares the price obtained from the call to `currentSharePrice()` with that of the previous round to adjust for the best of both. The same comparison is not performed in`rollToNextRound()` while calculating `amountToWithdraw`, which may not be desirable.

LowNo Implementations for `getPendingValue()`Acknowledged

The Strategy contracts do not currently implement `Strategy.getPendingValue()`. Instead, the pending value is included in `getInvestedValue()`, which makes a call to `checkPendingAssets()`. While this doesn't currently cause accounting problems, it doesn't use the abstractions in place and could result in unexpected behavior when integrating with outside contracts.

LowWithdrawals Can RevertAcknowledged

`StrategyController.forceWithdraw()` makes a call to `Strategy(strategy).instantWithdraw(withAmount)`. This function is expected to withdraw whatever funds possible and not revert (as opposed to `StrategyController._withdrawFromStrategy()` calling `Strategy(_strategy).withdraw(_amount)`). However, none of the current implementations of `Strategy.instantWithdraw()` correctly gather the requested funds. * `NativeLendingETHStrategy.instantWithdraw()`: Leaves potential funds in the LP token. * `SymbioticDepositWstETHStrategy.instantWithdraw()`: Is unable to syncronously withdraw additional ETH as it needs to submit withdrawal requests from Lido. * `EigenLSTRestaking.instantWithdraw()`: Is unable to syncronously withdraw additional ETH as it needs to submit withdrawal requests from Lido. All three of these functions will revert if the amount withdrawn exceeds the amount of ETH in the contract. With the current usages, this could prevent some users from being able to call `StoneVault.instantWithdraw()`. Additionally, it is possible for the implementations of `Strategy.withdraw()` to revert as well. This could result in blocking calls to `StrategyController._rebase()` until the admin makes the ETH available for each of the strategies. This will in turn prevent calls to `StoneVault.rollToNextRound()`.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (36)

https://github.com/stakestone/stone-vault-v1/contracts/strategies/NativeLendingETHStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IWstETH.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/token/L2Stone.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/scripts/deployMainnetCrossChain.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/governance/Proposal.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/Strategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/token/Stone.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/StrategyV2.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IDelegationManager.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/truffle-config.template.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ILidoWithdrawalQueue.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/test/testCarnival.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/SymbioticDepositWstETHStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/StrategyController.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/scripts/deploymentOnMainnet.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/SwappingAggregator.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/eigen/Account.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IWETH9.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IEigenStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/package.json at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ICollateral.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IAquaLpToken.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/scripts/deployment.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/token/StoneOFT.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/AssetsVault.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/eigen/EigenLSTRestaking.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IDelayedWithdrawalRouter.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/scripts/deployLZToken.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ILido.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IStrategyManager.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IStableSwap.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/scripts/deploymentOnForkedMainnet.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/token/Minter.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/libraries/VaultMath.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/StoneVault.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
https://github.com/stakestone/stone-vault-v1/contracts/strategies/EigenStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b

Part of StakeStone’s security record

StakeStone

Audits4 audits by 1 firmLast audit Oct 2025, by Quantstamp.

Critical findingsNo open critical findingsAcross 4 reports.

Open StakeStone’s security record

Security firm

Quantstamp

236 projects reviewed · 332 reports · latest Oct 2026

See Quantstamp’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us