Rocket Pool security record
As of 29 Oct 2026, Rocket Pool has 5 audit reports by 2 security firms on Trustblock; the latest is by Sigma Prime, dated 1 Sep 2024. Those reports list 2 open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits5
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Rocket Pool 10 Houston Hotfix security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Rocket Pool 8 Houston Pdao security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| Rocket Pool (Houston) | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Rocket Pool Atlas (v1. | Security firm: Consensys | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · diligence.security |
| Rocketpool | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | 2 open critical findings | Open · diligence.security |
Findings96
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 6 |
| High | 5 | 1 | 11 |
| Medium | 9 | 1 | 14 |
| Low | 22 | 1 | 24 |
CriticalRocketDaoNodeTrusted - DAO takeover during deployment/bootstrappingRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportCriticalRocketDAOProtocolSettings/RocketDAONodeTrustedSettings - anyone can set/overwrite settings until contract is declared “deployed”Rocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportHighMultiple checks-effects violationsRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportHighRocketDAONodeTrustedActions - No way to access ETH provided by non-member votesRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportHighRocketMinipoolDelegate - Sandwiching of Minipool calls can have unintended side effectsRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportHighRocketRewardPool - Unpredictable staking rewards as stake can be added just before claiming and rewards may be paid to to operators that do not provide a service to the systemRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportHighRocketStorage - Risk concentration by giving all registered contracts permissions to change any settings in RocketStorageRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportMediumKicked oDAO members’ votes taken into accountRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportMediumMinipool state machine design and pseudo-statesRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportMediumRocketDAOProtocolSettingsRewards - missing setting delimitersRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportShow 10 more
MediumRocketDAOProtocolSettingsRewards - settings key collissionRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportMediumRocketNodeDistributor - Missing extcodesize check in dynamic proxyRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportMediumSparse documentation and accounting complexityRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportMediumDeployment - Docker containers running as rootRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportMediumRocketDAO - personally identifiable member information (PII) stored on-chainRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportMediumTrusted/Oracle-Nodes can vote multiple times for different outcomesRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowInconsistent Coding StyleRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportLowInefficiencies with the onlyMinipoolOwner modifierRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportLowRedundant double castsRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportLowRocketDAO*Settings - settingNameSpace should be immutableRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportShow 10 more
LowRocketMinipool - Inconsistent access control modifier declaration onlyMinipoolOwnerRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportLowUnused ImportsRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportLowUse of address instead of specific contract typesRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Open
The report gives no description here.
Open the reportLowAvoid bypassing the solidity type system with unnecessary low-level callsRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowAvoid shadowing inherited namesRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowCasting to the contracts own contract type and address can be avoided by calling this.<function>Rocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowConsistent documentation using NatSpecRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowDeployment - Overloaded Ubuntu base imageRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowHandle recoverable exceptions in off-chain node utilitiesRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowPotential for collisions when writing/reading settings due to keccak(abi.encodePacked())Rocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportShow 8 more
LowPotential Gas OptimizationsRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowRocketDepositPool - Potential gasDoS in assignDepositsRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowRocketMinipool - getWithdrawalCredentials can be simplifiedRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowRocketVault - Consider using SafeERC for third party ERC20 interactions or whitelist allowed tokensRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowRocketVault - Follow checks-effects-interactions for token withdrawalRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowStatevariables that cannot change should be declared constant or ‘immutable’Rocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowUse a logging framework to securely print log messages and encode output to fmt.print*Rocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportLowWhere possible, a specific contract type should be used rather than addressRocketpool · Consensys · 1 Apr 2021Open
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="rocket-pool"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us