ether.fi security record
As of 31 Oct 2026, ether.fi has 3 audit reports by 3 security firms on Trustblock; the latest is by Decurity, dated 4 Aug 2024. Those reports list no open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Etherfi Liquifier Diff audit | Security firm: Decurity | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| EtherFi security assessment | Security firm: Zellic | Date: | Scope: Not recorded (see the report) | 5 critical findings, fixed | Open · GitHub |
| EtherFi | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings18
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 5 |
| High | 1 | 0 | 1 |
| Medium | 0 | 0 | 4 |
| Low | 1 | 2 | 4 |
CriticalBNFT holder could cancel the deposit after processNodeExit is calledEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportCriticalETH sent to wrong address on cancellationEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportCriticalMalicious users could use the ETH of legitimate users and mint themselves NFTsEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportCriticalRepeated validator IDs could be passed in batchRevertExitRequestEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportCriticalRepeated validator IDs could be passed in batchSendExitRequestEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportHighWrong rewards calculation due to numAssociatedValidatorsEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportMediumDeposit cancellation may fail if the etherFiNode version is not updatedEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportMediumQueued withdrawals are not claimed by forcePartialWithdrawEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportMediumThe BNFT holder is compared with an incorrect addressEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect Total User BalanceEtherFi · CertiK · 25 Feb 2023Fixed
According to the comment of the function `calculateUserPoints()`, the function is used to calculate how many points a user currently has accumulated. The argument `_user` represent the real user account. However, the total user balance is calculated based on both of the balance of the `_user` and `msg.sender`. The `_user` may not be equal to `msg.sender`. ```solidity=181 /// @notice Calculates how many points a user currently has owed to them /// @return the amount of points a user currently has accumulated function calculateUserPoints(address _user) public view returns (uint256) { uint256 lengthOfDeposit; if (claimingOpen == 0) { lengthOfDeposit = block.timestamp - depositInfo[_user].depositTime; } else { lengthOfDeposit = endTime - depositInfo[_user].depositTime; } //Variable to store how many milestones (3 days) the user deposit lasted uint256 numberOfMultiplierMilestones = lengthOfDeposit / 259200; if (numberOfMultiplierMilestones > 10) { numberOfMultiplierMilestones = 10; } uint256 userMultiplier = numberOfMultiplierMilestones * multiplierCoefficient; uint256 totalUserBalance = depositInfo[_user].etherBalance + depositInfo[msg.sender].totalERC20Balance; //Formula for calculating points total return (((Math.sqrt(totalUserBalance) * lengthOfDeposit) / SCALE) * userMultiplier) / 100; } ```
Open the reportShow 4 more
Low[PR-28] The admins can sweep tokens from eigenPodEtherfi Liquifier Diff audit · Decurity · 4 Aug 2024Fixed
The report gives no description here.
Open the reportLowReward and withdrawal payout getters might fail if the etherFiNode version is not updatedEtherFi security assessment · Zellic · 13 Mar 2024Fixed
The report gives no description here.
Open the reportLowQuestionable Total User Balance in `transferFundsEtherFi · CertiK · 25 Feb 2023Fixed
In L219, the value of `totalUserBalance` is calculated by plusing the number of native tokens of `msg.sender` and the number of erc20 tokens that `msg.sender` has deposited into the current contract. It is weird to plus different asset's balances from a different account. Since the value is just used to emit events, we couldn't understand this variable quite well. ```solidity=218 function transferFunds(uint256 _identifier) internal returns (uint256) { uint256 totalUserBalance = msg.sender.balance + depositInfo[msg.sender].totalERC20Balance; ```
Open the reportLowVariables That Could Be Declared as ImmutableEtherFi · CertiK · 25 Feb 2023Fixed
The linked variables assigned in the constructor can be declared as `immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. A big advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they will not be stored in storage.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="etherfi"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us