EtherFi security assessment
Zellic reviewed ether.fi (EtherFi security assessment) on 13 Mar 2024: 10 findings, 5 critical; all marked fixed.
Report hosted on GitHub.
Trustblock does not review code.
Findings10
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 0 | 0 | 1 |
| Medium | 0 | 0 | 3 |
| Low | 0 | 0 | 1 |
CriticalBNFT holder could cancel the deposit after processNodeExit is calledFixed
The report gives no description here.
CriticalETH sent to wrong address on cancellationFixed
The report gives no description here.
CriticalMalicious users could use the ETH of legitimate users and mint themselves NFTsFixed
The report gives no description here.
CriticalRepeated validator IDs could be passed in batchRevertExitRequestFixed
The report gives no description here.
CriticalRepeated validator IDs could be passed in batchSendExitRequestFixed
The report gives no description here.
HighWrong rewards calculation due to numAssociatedValidatorsFixed
The report gives no description here.
MediumDeposit cancellation may fail if the etherFiNode version is not updatedFixed
The report gives no description here.
MediumQueued withdrawals are not claimed by forcePartialWithdrawFixed
The report gives no description here.
MediumThe BNFT holder is compared with an incorrect addressFixed
The report gives no description here.
LowReward and withdrawal payout getters might fail if the etherFiNode version is not updatedFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of ether.fi’s security record
ether.fiSecurity firm
Zellic28 projects reviewed · 31 reports · latest Apr 2026
See Zellic’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us