StakeStone
Quantstamp reviewed StakeStone on 25 Jul 2024: 11 findings, 0 critical; 5 marked fixed, 5 acknowledged, 1 open.
Report hosted on certificate.quantstamp.com.
Trustblock does not review code.
Findings11
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 1 | 0 | 2 |
| Low | 0 | 5 | 3 |
Medium`EigenLSTRestaking` Strategy Manager May Arbitrarily Withdraw stEthFixed
The strategy manager may perform arbitrary calls on the `tokenAddr` contract by calling `invoke()`. This could be abused to request withdrawals and/or claim any queued withdrawals to oneself.
MediumUncallable Configuration FunctionsFixed
Some contracts contain setter functions that are only callable by the `StoneVault` or `StrategyController`. However, these setter functions are never called in the `StoneVault` or `StrategyController` contracts. If the configuration of the protocol changes, these contracts may not be updated accordingly. The following is a list of found functions: - `AssetVault.setNewVault()` - `Minter.setNewVault()` - `StrategyController.setNewVault()` - `SwappingAggregator.setSlippage()` - `SwappingAggregator.setUniRouter()` - `SwappingAggregator.setCurveRouter()` - `SwappingAggregator.setNewGovernance()`
Low`Account.invoke()` Cannot Call the ControllerFixed
The constructor in the `Account` contract has the following line: ``` controller = EigenStrategy(address(this)).controller(); ``` Rather than referring to an outside contract, `EigenStrategy` wraps `address(this)`. The `controller` variable is effectively assigned to itself and will remain zero, leading all calls to the controller in `invoke()` to revert. Additionally, `invoke()` may arbitrarily execute external contract calls when `value` equals zero.
Low`requestToEther()` May Return Incorrect AmountFixed
The `EigenLSTRestaking.swapToEther()` and `SymbioticDepositWstETHStrategy.requestToEther()` functions submit withdrawal requests to the `LidoWithdrawalQueue`. The functions return `etherAmount = amount` to indicate how much ETH was requested to be withdrawn. However, when `remainder < minAmountPerRequest`, this value will incorrectly include the `remainder`.
LowSome Proposals Can Make Stone Non-RefundableFixed
Voters stake their STONE into the `Proposal` contract under the pretense that they can withdraw their STONE after the proposal has completed. Executing a proposal involves calling `Proposal.invoke()`, which calls `stoneVault.call{value: 0}(data)`. If a proposal passes that calls `StoneVault.requestWithdraw()`, it will use the STONE that was staked by voters into the `Proposal` contract. This will make it impossible to return STONE to all voters. Given this exploit scenario would have to be approved by voters, the severity has been left as Informational.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (36)
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/NativeLendingETHStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IWstETH.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/token/L2Stone.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/scripts/deployMainnetCrossChain.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/governance/Proposal.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/Strategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/token/Stone.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/StrategyV2.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IDelegationManager.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/truffle-config.template.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ILidoWithdrawalQueue.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/test/testCarnival.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/SymbioticDepositWstETHStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/StrategyController.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/scripts/deploymentOnMainnet.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/SwappingAggregator.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/eigen/Account.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IWETH9.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IEigenStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/package.json at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ICollateral.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IAquaLpToken.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/scripts/deployment.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/token/StoneOFT.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/AssetsVault.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/eigen/EigenLSTRestaking.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IDelayedWithdrawalRouter.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/scripts/deployLZToken.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/ILido.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IStrategyManager.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/interfaces/IStableSwap.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/scripts/deploymentOnForkedMainnet.js at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/token/Minter.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/libraries/VaultMath.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/StoneVault.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
- https://github.com/stakestone/stone-vault-v1/contracts/strategies/EigenStrategy.sol at commit d34a1ec054eaef364cb18952ae66495bd0be4a9b
Part of StakeStone’s security record
StakeStoneSecurity firm
Quantstamp236 projects reviewed · 332 reports · latest Oct 2026
See Quantstamp’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us