Rocketpool
Consensys reviewed Rocket Pool (Rocketpool) on 1 Apr 2021: 53 findings, 5 critical; 31 marked fixed, 22 open.
Report hosted on diligence.security.
Trustblock does not review code.
Findings53
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 3 |
| High | 2 | 0 | 7 |
| Medium | 3 | 0 | 8 |
| Low | 15 | 0 | 13 |
CriticalRocketDaoNodeTrustedActions - Incomplete implementation of member challenge processFixed
The report gives no description here.
CriticalRocketStorage - anyone can set/update values before the contract is initializedFixed
The report gives no description here.
CriticalRocketTokenRETH - sandwiching opportunity on price updatesFixed
The report gives no description here.
HighRocketDAONodeTrustedUpgrade - upgrade does not prevent the use of the same address multiple times creating an inconsistency where getContractAddress returns outdated informationFixed
The report gives no description here.
HighRocketDAOProposals - Unpredictable behavior due to short vote delayFixed
The report gives no description here.
HighRocketNodeStaking - Node operators can reduce slashing impact by withdrawing excess staked RPLFixed
The report gives no description here.
HighRocketpool CLI - Lax data validation and output sanitationFixed
The report gives no description here.
HighRocketpool CLI - Various command injection vectorsFixed
The report gives no description here.
HighRocketTokenRPL - inaccurate inflation rate and potential for manipulation lowering the real APYFixed
The report gives no description here.
HighTrusted node participation risk and potential client “optimizations”Fixed
The report gives no description here.
Show 10 more
MediumRocketDAONodeTrustedActions - member cannot be kicked if the vault does not hold enough RPL to cover the bondFixed
The report gives no description here.
MediumRocketDAONodeTrustedUpgrade - inconsistent upgrade blacklistFixed
The report gives no description here.
MediumRocketDAOProposals - require a minimum participation quorum for DAO proposalsFixed
The report gives no description here.
MediumRocketMiniPoolDelegate - on destroy() leftover ETH is sent to RocketVault where it cannot be recoveredFixed
The report gives no description here.
MediumRocketMinipoolStatus - DAO Membership changes can result in votes getting stuckFixed
The report gives no description here.
MediumRocketpool CLI - Insecure SSH HostKeyCallbackFixed
The report gives no description here.
MediumRocketPoolMinipool - should check for address(0x0)Fixed
The report gives no description here.
MediumRocketTokenNETH - Pot. discrepancy between minted tokens and deposited collateralFixed
The report gives no description here.
LowRocketAuctionManager - calcBase should be declared constantFixed
The report gives no description here.
LowRocketDAO* - daoNamespace is missing a trailing dot; should be declared constant/immutableFixed
The report gives no description here.
Show 10 more
LowRocketDaoNodeTrusted - Unused eventsFixed
The report gives no description here.
LowRocketDAONodeTrustedAction - ambiguous event emitted in actionChallengeDecideFixed
The report gives no description here.
LowRocketDAOProposal - expired, and defeated proposals can be canceledFixed
The report gives no description here.
LowRocketDAOProposal - preserve the proposals correct state after expirationFixed
The report gives no description here.
LowRocketDAOProtocolProposals, RocketDAONodeTrustedProposals - unused enum ProposalTypeFixed
The report gives no description here.
LowRocketMinipoolDelegate - enforce that the delegate contract cannot be called directlyFixed
The report gives no description here.
LowRocketNetworkPrices - Price feed update lacks block number sanity checkFixed
The report gives no description here.
LowRocketNetworkWithdrawal - ETH dust lockup due to rounding errorsFixed
The report gives no description here.
LowRocketRewardsPool - registerClaimer should check if a node is already disabled before decrementing rewards.pool.claim.interval.claimers.total.nextFixed
The report gives no description here.
LowRocketVault - consider rejecting zero amount deposit/withdrawal requestsFixed
The report gives no description here.
Show 1 more
LowRocketVault - methods returning static return values and unchecked return parametersFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Rocket Pool’s security record
Rocket PoolSecurity firm
Consensys41 projects reviewed · 59 reports · latest Oct 2024
See Consensys’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us