Stakewise - v3 Vaults / EthFoxVault

Off-Chain (Private)

Audited on 2024/02/29

No active critical issues

Summary

Executive Summary This report presents the results of our engagement with StakeWise and Consensys to review v3 Vaults/EthFoxVault implementation for Consensys. The review was conducted over three weeks, from January 29, 2024, to March 1, 2024. A total of 30 person-days were spent. Stakewise V3 is a liquid staking protocol set to be utilized by Consensys as the underlying system for Metamask Staking. This modular system comprises a collection of customizable modules that define the behavior of a staking vault.

Project

Stakewise Landing

Ethereum

Issues (15)

	Low	Medium	High	Critical	Total
Not fixed	9	4	-	-	13
Fixed	1	1	-	-	2
Total	10	5	0	0	15

Contracts (55)

#	File Name
21	v3-core/contracts/interfaces/IChainlinkAggregator.sol
22	v3-core/contracts/interfaces/IVaultEthStaking.sol
23	v3-core/contracts/interfaces/IVaultValidators.sol
24	v3-core/contracts/interfaces/IRewardEthToken.sol
25	v3-core/contracts/vaults/VaultsRegistry.sol
26	v3-core/contracts/interfaces/IVaultsRegistry.sol
27	v3-core/contracts/interfaces/IOsTokenVaultController.sol
28	v3-core/contracts/interfaces/IEthFoxVault.sol
29	v3-core/contracts/interfaces/IEthGenesisVault.sol
30	v3-core/contracts/vaults/modules/VaultImmutables.sol

#	File Name
21	v3-core/contracts/interfaces/IChainlinkAggregator.sol
22	v3-core/contracts/interfaces/IVaultEthStaking.sol
23	v3-core/contracts/interfaces/IVaultValidators.sol
24	v3-core/contracts/interfaces/IRewardEthToken.sol
25	v3-core/contracts/vaults/VaultsRegistry.sol
26	v3-core/contracts/interfaces/IVaultsRegistry.sol
27	v3-core/contracts/interfaces/IOsTokenVaultController.sol
28	v3-core/contracts/interfaces/IEthFoxVault.sol
29	v3-core/contracts/interfaces/IEthGenesisVault.sol
30	v3-core/contracts/vaults/modules/VaultImmutables.sol

Stakewise - v3 Vaults / EthFoxVault

Summary

Issues (15)

Inconsistent Interface Between Similar Functionality: Whitelist / Blocklistnot_fixed/medium

KeeperRewards.canUpdateRewards() and VaultMev._harvestAssets() Can Theoretically Overflownot_fixed/medium

User Can Prevent Blocklist Manager From Ejecting Them by Reverting on ETH Transfernot_fixed/medium

VaultsRegistry Allows Owner to Bypass VaultFactorynot_fixed/medium

_processTotalAssetsDelta() Should Return Early on totalAssetsDelta == 0not_fixed/low

Contracts (55)