Puffer security review
Audit · firm’s term: security review
Nethermind Security reviewed Puffer (Puffer security review) on 16 Apr 2024: 8 findings, 0 critical; 6 marked fixed, 2 acknowledged.
Report hosted on GitHub.
Trustblock does not review code.
Findings8
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 1 |
| Low | 0 | 1 | 4 |
Marked Info or Best Practices by the firm. Not counted as findings.
InfoChanging the daily withdrawal limit resets daily withdrawalsAcknowledged
The report gives no description here.
InfoFunction addGuardian(...) does not check if the address to be added as a Guardian is an EOAAcknowledged
The report gives no description here.
InfoLack of slippage protection when purchasing validator ticketAcknowledged
The report gives no description here.
InfoSlasher is not implemented in the upgraded version of EigenLayer contractsAcknowledged
The report gives no description here.
InfoDisabling function depositToEigenLayer(...) in PufferVaultV2Fixed
The report gives no description here.
InfoDuplicate codeFixed
The report gives no description here.
InfoInappropriate names for functions and variablesFixed
The report gives no description here.
Best PracticesIncorrect comments about ValidatorTicket feeFixed
The report gives no description here.
InfoInvariant violation in function setValidatorLimitPerModule(...)Fixed
The report gives no description here.
Best PracticesLack of _disableInitializers() in some upgradable contractsFixed
The report gives no description here.
Show 5 more
InfoMissing input validationsFixed
The report gives no description here.
InfoModule is not validated to have a name different than NO_VALIDATORSFixed
The report gives no description here.
Best PracticesUnnecessary cast to uint56 when setting priceFixed
The report gives no description here.
Best PracticesUnnecessary external call to get deposit data rootFixed
The report gives no description here.
InfoUnnecessary usage of _disableInitializers() in the constructor of PufferDepositorV2Fixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Puffer’s security record
PufferSecurity firm
Nethermind Security57 projects reviewed · 81 reports · latest Sep 2026
See Nethermind Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us