Rocketpool
Consensys reviewed Rocket Pool (Rocketpool) on 1 Apr 2021: 53 findings, 5 critical; 31 marked fixed, 22 open.
Report hosted on diligence.security.
Trustblock does not review code.
Findings53
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 3 |
| High | 2 | 0 | 7 |
| Medium | 3 | 0 | 8 |
| Low | 15 | 0 | 13 |
CriticalRocketDaoNodeTrusted - DAO takeover during deployment/bootstrappingOpen
The report gives no description here.
CriticalRocketDAOProtocolSettings/RocketDAONodeTrustedSettings - anyone can set/overwrite settings until contract is declared “deployed”Open
The report gives no description here.
HighRocketRewardPool - Unpredictable staking rewards as stake can be added just before claiming and rewards may be paid to to operators that do not provide a service to the systemOpen
The report gives no description here.
HighRocketStorage - Risk concentration by giving all registered contracts permissions to change any settings in RocketStorageOpen
The report gives no description here.
MediumDeployment - Docker containers running as rootOpen
The report gives no description here.
MediumRocketDAO - personally identifiable member information (PII) stored on-chainOpen
The report gives no description here.
MediumTrusted/Oracle-Nodes can vote multiple times for different outcomesOpen
The report gives no description here.
LowAvoid bypassing the solidity type system with unnecessary low-level callsOpen
The report gives no description here.
LowAvoid shadowing inherited namesOpen
The report gives no description here.
LowCasting to the contracts own contract type and address can be avoided by calling this.<function>Open
The report gives no description here.
Show 10 more
LowConsistent documentation using NatSpecOpen
The report gives no description here.
LowDeployment - Overloaded Ubuntu base imageOpen
The report gives no description here.
LowHandle recoverable exceptions in off-chain node utilitiesOpen
The report gives no description here.
LowPotential for collisions when writing/reading settings due to keccak(abi.encodePacked())Open
The report gives no description here.
LowPotential Gas OptimizationsOpen
The report gives no description here.
LowRocketDepositPool - Potential gasDoS in assignDepositsOpen
The report gives no description here.
LowRocketMinipool - getWithdrawalCredentials can be simplifiedOpen
The report gives no description here.
LowRocketVault - Consider using SafeERC for third party ERC20 interactions or whitelist allowed tokensOpen
The report gives no description here.
LowRocketVault - Follow checks-effects-interactions for token withdrawalOpen
The report gives no description here.
LowStatevariables that cannot change should be declared constant or ‘immutable’Open
The report gives no description here.
Show 2 more
LowUse a logging framework to securely print log messages and encode output to fmt.print*Open
The report gives no description here.
LowWhere possible, a specific contract type should be used rather than addressOpen
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Rocket Pool’s security record
Rocket PoolSecurity firm
Consensys41 projects reviewed · 59 reports · latest Oct 2024
See Consensys’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us