CertiK reviewed unshETH (unshETH Protocol) on 23 Mar 2023: 5 findings, 0 critical; none marked fixed.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 5 | 0 | 0 |
Contract `Darknet` serves as the price oracle for the unshETH protocol, the address `lsd` and `fn_sig` will be set up in the deployment stage and there's no way to update in the later stage. This lacks flexibility.
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
The contract uses the console contract from Hardhat, which is meant to be used for testing purposes.
In the contract `EuclideanFarm.sol`, the following variables could be set to constant to save gas: ```solidity uint256 public max_cord_multiplier = uint256(3e18); uint256 public min_cord_multiplier = uint256(1e18); uint256 public max_nonce = 2; //no more than 2 changes to targetRatio ``` In the contract `LSDRegistry.sol`, the following variables could be set to constant to save gas: ```solidity uint256 public minUpdateCooldown = 21 days; //minimum number of time before ratios/tokens can be changed again uint256 public min_update_distance = 0.5e18; uint256 public max_nonce = 2; ``` These variables could be declared as `constant` since these state variables are never to be changed.
The following variables assigned in the constructor can be declared as `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. An advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they are not located in storage. ```solidity address public lsdVaultAddress; // 0xE76Ffee8722c21b390eebe71b67D95602f58237F; address public unshETHAddress; //0x846982C0a47b0e9f4c13F3251ba972Bb8D32a8cA; address public wstETHAddress; //0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0; address public frxETHAddress; //0xbafa44efe7901e04e39dad13167d089c559c1138; address public sfrxETHAddress; //0xac3e018457b222d93114458476f3e3416abbe38f; address public rETHRouterAddress; //0x16D5A408e807db8eF7c578279BEeEe6b228f1c1C; address public rETHAddress; //0xae78736cd615f374d3085123a210448e74fc6393; ```
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (10)
1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us