Rocketpool

Off-Chain (Private)

Audited on 2021/03/31

2 active critical issues

Summary

Executive Summary This report presents the results of our engagement with Rocket Pool to review the smart contract system, the go language bindings for smart contract interaction, and the Smart Node implementation. The review was conducted over five weeks, from March 8, 2021 to April 9, 2021. A total of 40 person-days were spent. Due to the audit’s extend, covering more than 6000 solidity source lines of code (ca 3.5k normalized) with 47 logic contracts in a complex smart contract system.

Project

Rocket Pool

Multi-Chain

Issues (53)

	Low	Medium	High	Critical	Total
Not fixed	15	3	1	2	21
Fixed	13	8	8	3	32
Total	28	11	9	5	53

Rocketpool

Summary

Issues (53)

RocketDaoNodeTrusted - DAO takeover during deployment/bootstrappingnot_fixed/critical

RocketDAOProtocolSettings/RocketDAONodeTrustedSettings - anyone can set/overwrite settings until contract is declared “deployed”not_fixed/critical

RocketStorage - Risk concentration by giving all registered contracts permissions to change any settings in RocketStoragenot_fixed/high

Deployment - Docker containers running as rootnot_fixed/medium

RocketDAO - personally identifiable member information (PII) stored on-chainnot_fixed/medium

Contract (1)