Swell Audit Report

Cyfrin23 Feb 2024Code version: not recorded (see the report)

Audit · firm’s term: audit report

Cyfrin reviewed Swell (Swell Audit Report) on 23 Feb 2024: 13 findings, 0 critical; 10 marked fixed, 3 acknowledged.

No open critical findings

Open Swell’s security record

The original report was removed from its address (seen 18 Oct 2026).

Trustblock does not review code.

Findings13

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	2
Low	0	3	8

MediumSwellLib.BOT can delete active validators when bot methods are pausedFixed

The report gives no description here.

MediumSwellLib.BOT can subtly rug-pull withdrawals by setting _processedRate = 0 when calling swEXIT::processWithdrawalsFixed

The report gives no description here.

LowAllowing anyone to finalize any withdrawal can lead to integration problems for smart contract allowed to receive ETHFixed

The report gives no description here.

LowCheck for staleness of data when fetching Proof of Reserves via Chainlink Swell ETH PoR OracleFixed

The report gives no description here.

LowMultiple attack paths to force swETH::reprice to revert by increasing or decreasing swETH total supplyFixed

The report gives no description here.

LowNodeOperatorRegistry::updateOperatorControllingAddress allows to override _newOperatorAddress if its address is already assigned to an operator IDFixed

The report gives no description here.

LowPrecision loss in swETH::_deposit from unnecessary hidden division before multiplicationFixed

The report gives no description here.

LowRewards unable to be distributed when all active validators are deleted during repricingFixed

The report gives no description here.

LowswExit::getProcessedRateForTokenId returns true with valid processedRate for non-existent tokenId inputFixed

The report gives no description here.

LowswEXIT::setWithdrawRequestMaximum and setWithdrawRequestMinimum lacking validation can lead to a state where withdrawRequestMinimum > withdrawRequestMaximumFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Swell’s security record

Swell

Audits10 audits by 6 firmsLast audit Apr 2025, by CODESPECT.

Critical findingsNo open critical findingsAcross 10 reports.

Open Swell’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.