unshETH Protocol

CertiKFiles named in the report

CertiK reviewed unshETH (unshETH Protocol) on 23 Mar 2023: 5 findings, 0 critical; none marked fixed.

No open critical findings
Open the reportOpen unshETH’s security record

Report hosted on skynet.certik.com.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

SeverityOpenAcknowledgedFixed
Critical000
High000
Medium000
Low500
LowLacks Flexibility Of Updating Oracle AddressesOpen

Contract `Darknet` serves as the price oracle for the unshETH protocol, the address `lsd` and `fn_sig` will be set up in the deployment stage and there's no way to update in the later stage. This lacks flexibility.

LowMissing Emit EventsOpen

There should always be events emitted in the sensitive functions that are controlled by centralization roles.

LowUsage of Hardhat's ConsoleOpen

The contract uses the console contract from Hardhat, which is meant to be used for testing purposes.

LowVariable could be declared as `constant`Open

In the contract `EuclideanFarm.sol`, the following variables could be set to constant to save gas: ```solidity uint256 public max_cord_multiplier = uint256(3e18); uint256 public min_cord_multiplier = uint256(1e18); uint256 public max_nonce = 2; //no more than 2 changes to targetRatio ``` In the contract `LSDRegistry.sol`, the following variables could be set to constant to save gas: ```solidity uint256 public minUpdateCooldown = 21 days; //minimum number of time before ratios/tokens can be changed again uint256 public min_update_distance = 0.5e18; uint256 public max_nonce = 2; ``` These variables could be declared as `constant` since these state variables are never to be changed.

LowVariables Can Be Declared as `Immutable`Open

The following variables assigned in the constructor can be declared as `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. An advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they are not located in storage. ```solidity address public lsdVaultAddress; // 0xE76Ffee8722c21b390eebe71b67D95602f58237F; address public unshETHAddress; //0x846982C0a47b0e9f4c13F3251ba972Bb8D32a8cA; address public wstETHAddress; //0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0; address public frxETHAddress; //0xbafa44efe7901e04e39dad13167d089c559c1138; address public sfrxETHAddress; //0xac3e018457b222d93114458476f3e3416abbe38f; address public rETHRouterAddress; //0x16D5A408e807db8eF7c578279BEeEe6b228f1c1C; address public rETHAddress; //0xae78736cd615f374d3085123a210448e74fc6393; ```

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Repository and files the report names (10)

  • src/unshETHZap.sol
  • src/Darknet.sol
  • src/unshETH.sol
  • src/EuclideanFarm.sol
  • src/CommunalFarm.sol
  • src/USH.sol
  • src/LSDRegistry.sol
  • src/LSDVault.sol
  • src/interfaces/IERC20.sol
  • src/ERC20/ERC20PermitPermissionedMint.sol

Part of unshETH’s security record

unshETH
Audits3 audits by 2 firmsLast audit Jun 2023, by Paladin.
Critical findingsNo open critical findingsAcross 3 reports.
IncidentIncident 30 May 2023Source: De.Fi incident database.
Open unshETH’s security record

Security firm

CertiK

1,044 projects reviewed · 1,375 reports · latest May 2025

See CertiK’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.

Tell us