StakeStone Tokenized Vault

Multi-Chain

Audited on 2025/10/14

No open critical findings

Summary

Stakestone is a decentralized tokenized vault protocol that allows users to deposit whitelisted ERC-20 assets into a vault contract and receive SSUSD vault tokens in return. The audit of the StakeStone USD Protocol smart contracts revealed several vulnerabilities and operational concerns that could be leveraged to exploit the system or hinder functionality. Key vulnerabilities include the lack of restrictions on adding the vault token as a withdrawal asset, which may lead to incorrect accounting and user confusion; inadequate validation of administrative roles that could result in loss of governance if initialized with a zero address; and the absence of upper bounds on price update intervals, allowing for potential denial-of-service scenarios. Furthermore, vulnerabilities related to oracle management can lead to significant price manipulation opportunities, particularly during periods of high market volatility, as the price update process does not adequately account for deviations or frequency caps that could block legitimate updates, causing extended arbitrage windows. Recommendations to mitigate these vulnerabilities include implementing thorough validation in key functions to restrict improper asset handling, establishing checks against zero addresses when managing roles, and introducing emergency procedures for price updates to address rapid market changes. Additionally, a comprehensive review of the withdrawal and state management processes is necessary. The protocol should implement improved checks during withdrawals and enhance governance functions to allow for asset recovery in edge cases, ensuring operational resiliency against unforeseen states or user actions. Ultimately, remediating these issues and refining operational structures is crucial for maintaining the integrity and security of the StakeStone USD Protocol. **Fix Review Update**: All vulnerabilities have been addressed and mitigated.

Project