Shentu - Restaking
CertiK reviewed Shentu Chain (Shentu - Restaking) on 7 Nov 2024: 6 findings, 0 critical; 5 marked fixed, 1 open.
Report hosted on skynet.certik.com.
Trustblock does not review code.
Findings6
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 1 | 0 | 0 |
| Medium | 0 | 0 | 2 |
| Low | 0 | 0 | 3 |
HighIncorrect Re-staking LogicOpen
Repository: - toolkit-restaking-service File: - toolkit-restaking-service/service/restake/restake.go The core logic of the `restake` function is to withdraw the staked assets and rewards from various validators at regular intervals, acting as the grantee, and then restake these withdrawn assets to generate additional returns. However, during this process, the `processRestake` function withdraws all staked assets using the `AuthzMsgWithdrawDelegatorReward` function, but when it restakes, it only delegates to the first validator in the `AllowValidatorAddrs` list. ```go =105 // Step 2: Redelegate the rewards amounts := cc.FilterCoinReceivedAmounts(txResp, grant.Granter) delegations := []stakingtypes.MsgDelegate{ { DelegatorAddress: grant.Granter, ValidatorAddress: grant.AllowValidatorAddrs[0], Amount: sdk.NewCoin(cc.Denom, sdk.NewInt(amounts)), }, } msgExec2 := cc.AuthzMsgDelegate(delegations) txHash, err = rs.handleTransaction(grant.Granter, msgExec2, priv, cc, clientCtx) ``` This `restake` logic is flawed. The correct approach is to record the staked assets received from different validators and restake them separately to ensure proper asset allocation across all specified validators. This incorrect restaking logic causes the originally distributed stakes across multiple validators to be concentrated into a single validator's address. This undoubtedly alters the user's staking strategy and could potentially lead to a loss in staking rewards.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Repository and files the report names (86)
- entity/chain_info.go
- service/cosmos/staking.go
- entity/account.go
- util/sign.go
- cmd/service/main.go
- cmd/generate/prepare.go
- controller/tx.go
- service/account.go
- pkg/util/logger.go
- main.go
- service/task.go
- util/aes_test.go
- util/aes.go
- model/cosmos.go
- entity/task_query.go
- entity/login.go
- dal/dao/multisig_history.gen.go
- model/chain.go
- lambda/chain-event/main.go
- tools/tools.go
- service/cosmos/sign.go
- service/cosmos/sign_test.go
- util/logger.go
- service/cosmos/query_test.go
- cmd/service/main_test.go
- entity/transaction.go
- dal/model/multisig_account.gen.go
- lambda/chain-event/core/task_msg.go
- dal/model/pending_transaction.gen.go
- util/addr.go
- pkg/util/aes.go
- service/transactions.go
- service/cosmos/staking_test.go
- pkg/util/config.go
- entity/errno/code.go
- dao/task.go
- service/cosmos/multisig_test.go
- service/user.go
- dao/db.go
- controller/response_data.go
- router/loader.go
- controller/task.go
- service/cosmos/type.go
- pkg/util/aes_test.go
- entity/user.go
- service/chain_registry.go
- util/token_test.go
- service/cosmos/keys.go
- common/html_meta.go
- dao/user.go
- lambda/chain-event/core/db_test.go
- controller/account.go
- cmd/generate/gen.go
- dal/dao/gen.go
- pkg/util/config_test.go
- util/time.go
- util/tools.go
- util/shentu.go
- service/restake/restake.go
- cmd/sub-service/main.go
- entity/task.go
- util/config.go
- entity/errno/errno.go
- dal/dao/multisig_account.gen.go
- middleware/auth.go
- lambda/chain-event/core/sqs.go
- lambda/chain-event/core/db.go
- controller/user.go
- controller/login.go
- dao/files.go
- common/const.go
- router/header.go
- dal/dal.go
- util/http.go
- dal/dao/pending_transaction.gen.go
- tools/patterns.go
- util/sign_test.go
- service/chain_registry_test.go
- service/restake/restake_test.go
- util/token.go
- util/http_test.go
- util/time_test.go
- service/cosmos/authz.go
- service/cosmos/query.go
- dal/model/multisig_history.gen.go
- service/cosmos/keys_test.go
Part of Shentu Chain’s security record
Shentu ChainSecurity firm
CertiK1,044 projects reviewed · 1,375 reports · latest May 2025
See CertiK’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us