liquid staking token security review

Extropy21 Oct 20242 addresses on LUKSO

Audit · firm’s term: security review

Extropy reviewed Stakingverse (liquid staking token security review) on 21 Oct 2024: 6 findings, 0 critical; 5 marked fixed, 1 open.

No open critical findings

Open the report Open Stakingverse’s security record

Report stored on IPFS. Content hash bafybeih2b2srxlp6rezy5iqitf22ov3seofqitsna3d6pgemiqv7k7au5m

Trustblock does not review code.

Findings6

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	0	2
Medium	0	1
Low	1	2

HighAccounting can be compromised if the sLYXToken contract address is the deposit beneficiaryFixed

Within Vault.sol the deposit() function allows users to deposit LYX tokens to the vault, which results in increasing the value stored in shares[] mapping for the beneficiary address in input depending on the deposit size.

HighCode invariant can be brokenFixed

Within LiquidStakingToken.sol the functions getNativeTokenValue() and getLiquidStakingTokenValue() makes use of sharesOf() to compute the total amount of shares held by the LiquidStakingToken contract.

MediumCentralized roles in ‘Vault‘Fixed

The contract Vault contains two centralized roles:

LowMissing checksFixed

The report gives no description here.

LowUnverified implementation for ‘Vault‘ contractFixed

The report gives no description here.