Launchnodes Lido Liquid Staking
OXORIO reviewed Lido (Launchnodes Lido Liquid Staking) on 13 Dec 2024: 51 findings, 6 critical; 49 marked fixed, 2 acknowledged.
Report hosted on audits.oxor.io.
Trustblock does not review code.
Findings51
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 6 |
| High | 0 | 0 | 5 |
| Medium | 0 | 1 | 11 |
| Low | 0 | 1 | 27 |
CriticalContract lock risk on initial stake in NGOLisFixed
The report gives no description here.
CriticalDecrease in stETH balance due to slashing or penalties is not accounted for in NGOLisFixed
The report gives no description here.
CriticalRounding during division leads to accumulation of undistributed rewards on the contract in NGOLisFixed
The report gives no description here.
CriticalThe setImplementetion function is executed without authorization in NGOLisFactoryFixed
The report gives no description here.
CriticalUnrestricted withdrawal of small stETH/wstETH amounts in NGOLisFixed
The report gives no description here.
CriticalWithdrawal of more ETH from the protocol than returned by Lido in NGOLisFixed
The report gives no description here.
HighIncorrect update of lastNGOBalance in NGOLisFixed
The report gives no description here.
HighRisk of Zero Calculation for Low _ratio and _ngoAssets in NGOLisFixed
The report gives no description here.
HighUnderflow occurring during validator slashing events in NGOLisFixed
The report gives no description here.
HighUnderflow when attempting to withdraw asset from prevRewards in NGOLisFixed
The report gives no description here.
Show 10 more
HighUnwithdrawable balance after withdrawal in NGOLisFixed
The report gives no description here.
MediumEquality of minimum values for different tokens wstEth and stEth in NGOLisFixed
The report gives no description here.
MediumFunction __ReentrancyGuard_init is not called during initialization in NGOLisFixed
The report gives no description here.
MediumInconsistency in the calculation of userTotalShareWithNgoReward and rewardToNgo in NGOLisFixed
The report gives no description here.
MediumIncorrect value in the WithdrawClaimed event in NGOLisFixed
The report gives no description here.
MediumInsufficient validation of the size of _amount for withdrawal requests in NGOLisFixed
The report gives no description here.
MediumPossible to pass a zero _amount in NGOLisFixed
The report gives no description here.
MediumPossible to receive a zero amount of shares when converting non-zero assets in NGOLisFixed
The report gives no description here.
MediumProxy creation uses ERC1967Proxy instead of NGOLisProxy in NGOLisFactoryFixed
The report gives no description here.
MediumStakeInfo is not updated during withdraw operations in NGOLisFixed
The report gives no description here.
Show 10 more
MediumUser does not receive rewards for staking when shares == 0 in NGOLisFixed
The report gives no description here.
MediumUsers cannot withdraw stuck funds from the contract in NGOLisFixed
The report gives no description here.
LowBalance calculation before checking for stake existence in NGOLisFixed
The report gives no description here.
LowDelay between reward distributions changes after contract initialization in NGOLisFixed
The report gives no description here.
LowEvent name in the specification is misleading in NGOLisFactoryFixed
The report gives no description here.
LowInconsistency in error notification methods in NGOLisFixed
The report gives no description here.
LowInconsistent state variable naming style in NGOLis, NGOLisFactoryFixed
The report gives no description here.
LowIncorrect event parameter value wstEth instead of stEth in NGOLisFixed
The report gives no description here.
LowInsufficient validation in the case of the very first stake in NGOLisFixed
The report gives no description here.
LowInterface not used in IAccountOracle.solFixed
The report gives no description here.
Show 10 more
LowMisleading variable name wstAmount instead of stAmount in NGOLisFixed
The report gives no description here.
LowMissing event emissions in setters in NGOLis, NGOLisFactoryFixed
The report gives no description here.
LowMissing parameter validation in NGOLis, NGOLisFactoryFixed
The report gives no description here.
LowNo _disableInitializers call in the constructor in NGOLisFixed
The report gives no description here.
LowNo parameter validation in NGOLisFixed
The report gives no description here.
LowNo setter parameter validation in NGOLisFixed
The report gives no description here.
LowRedundant check for unsigned value being negative in NGOLisFixed
The report gives no description here.
LowRedundant increment operation in NGOLisFixed
The report gives no description here.
LowRedundant storage of the totalAssets value in NGOLisFixed
The report gives no description here.
LowSetting msg.sender as owner during deployment in NGOLisFactoryFixed
The report gives no description here.
Show 9 more
LowSetting msg.sender instead of owner in the mapping ownerToNgo in NGOLisFactoryFixed
The report gives no description here.
LowSimilar code in identical functions in NGOLisFixed
The report gives no description here.
LowSimultaneous use of uint and uint256 typesFixed
The report gives no description here.
LowSuboptimal computation of user balance in NGOLisFixed
The report gives no description here.
LowSuboptimal handling of storage variables in NGOLisFixed
The report gives no description here.
LowTransfer of zero _fee is possible in NGOLisFixed
The report gives no description here.
LowUnused contracts in NGOLis.sol, NGOLisFactory.solFixed
The report gives no description here.
LowUnused error in NGOLisFixed
The report gives no description here.
LowUnused variable _prevRewards in NGOLisFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (8)
- contracts/NGOLisFactory.sol
- contracts/libs/ERC6551BytecodeLib.sol
- contracts/interfaces/IAccountOracle.sol
- contracts/NGOLis.sol
- contracts/interfaces/IWithdrawalQueue.sol
- contracts/interfaces/IERC20.sol
- contracts/interfaces/ILido.sol
- contracts/NGOLisProxy.sol
Part of Lido’s security record
LidoSecurity firm
OXORIO6 projects reviewed · 15 reports · latest Dec 2024
See OXORIO’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us