Rocket Pool security record
As of 30 Oct 2026, Rocket Pool has 5 audit reports by 2 security firms on Trustblock; the latest is by Sigma Prime, dated 1 Sep 2024. Those reports list 2 open critical findings.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits5
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Rocket Pool 10 Houston Hotfix security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Rocket Pool 8 Houston Pdao security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| Rocket Pool (Houston) | Security firm: Consensys | Date: | Scope: Files named in the report | No open critical findings | Open · diligence.security |
| Rocket Pool Atlas (v1. | Security firm: Consensys | Date: | Scope: Files named in the report | 1 critical finding, fixed | Open · diligence.security |
| Rocketpool | Security firm: Consensys | Date: | Scope: Not recorded (see the report) | 2 open critical findings | Open · diligence.security |
Findings96
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 2 | 0 | 6 |
| High | 5 | 1 | 11 |
| Medium | 9 | 1 | 14 |
| Low | 22 | 1 | 24 |
CriticalChallenges Can Be Manipulated Through Arbitrary Path Traversal To Steal Proposal BondRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportCriticalETH Locked In RocketNodeDeposit ContractRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportCriticalRocketNodeDistributorDelegate - Reentrancy in distribute() allows node owner to drain distributor fundsRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Fixed
The report gives no description here.
Open the reportCriticalRocketDaoNodeTrustedActions - Incomplete implementation of member challenge processRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportCriticalRocketStorage - anyone can set/update values before the contract is initializedRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportCriticalRocketTokenRETH - sandwiching opportunity on price updatesRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighIncorrect Computation Of claimIntervalsPassedRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportHighIncorrect Offset When Setting periodsPaidRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportHighIncorrect RPL Stake Calculation During WithdrawalRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportHighRocketMinipoolDelegateOld - Node operator may reenter finalise() to manipulate accountingRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Fixed
The report gives no description here.
Open the reportShow 10 more
HighRocketDAONodeTrustedUpgrade - upgrade does not prevent the use of the same address multiple times creating an inconsistency where getContractAddress returns outdated informationRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighRocketDAOProposals - Unpredictable behavior due to short vote delayRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighRocketNodeStaking - Node operators can reduce slashing impact by withdrawing excess staked RPLRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighRocketpool CLI - Lax data validation and output sanitationRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighRocketpool CLI - Various command injection vectorsRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighRocketTokenRPL - inaccurate inflation rate and potential for manipulation lowering the real APYRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportHighTrusted node participation risk and potential client “optimizations”Rocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumChallenged Leaf Indices Can Be Left Unverified OnchainRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportMediumChallengers Can Contest Non-Existent Indices To Steal Proposal BondRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportMediumIncorrect stake.for.allowed ValueRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportShow 10 more
MediumMissing Events on Important State ChangesRocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportMediumRocketDAOProtocolProposal._propose() Should Revert if _blockNumber > block.numberRocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportMediumRocketMinipoolDelegate - Redundant refund() call on forced finalizationRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Fixed
The report gives no description here.
Open the reportMediumRocketDAONodeTrustedActions - member cannot be kicked if the vault does not hold enough RPL to cover the bondRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumRocketDAONodeTrustedUpgrade - inconsistent upgrade blacklistRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumRocketDAOProposals - require a minimum participation quorum for DAO proposalsRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumRocketMiniPoolDelegate - on destroy() leftover ETH is sent to RocketVault where it cannot be recoveredRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumRocketMinipoolStatus - DAO Membership changes can result in votes getting stuckRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumRocketpool CLI - Insecure SSH HostKeyCallbackRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportMediumRocketPoolMinipool - should check for address(0x0)Rocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportShow 10 more
MediumRocketTokenNETH - Pot. discrepancy between minted tokens and deposited collateralRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowInconsistent Value On Estimated Block Per DayRocket Pool 10 Houston Hotfix security review · Sigma Prime · 1 Sep 2024Fixed
The report gives no description here.
Open the reportLowImplementation Discrepancies With RPIP SpecificationsRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportLowSnapshot Amendments May Lead To Leaf Verification FailuresRocket Pool 8 Houston Pdao security review · Sigma Prime · 1 Jun 2024Fixed
The report gives no description here.
Open the reportLowRedundant Comments ✓Rocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportLowRocketDAOProtocolSettingsRewards.setSettingRewardClaimPeriods() Cannot Be InvokedRocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportLowUnused Parameter and Improper Parameter Sanitization in RocketNetworkVoting.calculateVotingPower()Rocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportLowUse calldata Storage Location Instead of memory for Large Read-Only Data ✓Rocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportLowWrong/Misleading NatSpec DocumentationRocket Pool (Houston) · Consensys · 1 Dec 2023Fixed
The report gives no description here.
Open the reportLowCompiler error due to missing RocketMinipoolBaseInterfaceRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Fixed
The report gives no description here.
Open the reportShow 10 more
LowRocketMinipoolDelegate - Missing event in prepareVacancyRocket Pool Atlas (v1. · Consensys · 1 Jan 2023Fixed
The report gives no description here.
Open the reportLowRocketNodeDeposit - Duplicate check to avoid revert ✓Rocket Pool Atlas (v1. · Consensys · 1 Jan 2023Fixed
The report gives no description here.
Open the reportLowRocketAuctionManager - calcBase should be declared constantRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketDAO* - daoNamespace is missing a trailing dot; should be declared constant/immutableRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketDaoNodeTrusted - Unused eventsRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketDAONodeTrustedAction - ambiguous event emitted in actionChallengeDecideRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketDAOProposal - expired, and defeated proposals can be canceledRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketDAOProposal - preserve the proposals correct state after expirationRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketDAOProtocolProposals, RocketDAONodeTrustedProposals - unused enum ProposalTypeRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketMinipoolDelegate - enforce that the delegate contract cannot be called directlyRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportShow 5 more
LowRocketNetworkPrices - Price feed update lacks block number sanity checkRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketNetworkWithdrawal - ETH dust lockup due to rounding errorsRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketRewardsPool - registerClaimer should check if a node is already disabled before decrementing rewards.pool.claim.interval.claimers.total.nextRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketVault - consider rejecting zero amount deposit/withdrawal requestsRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportLowRocketVault - methods returning static return values and unchecked return parametersRocketpool · Consensys · 1 Apr 2021Fixed
The report gives no description here.
Open the reportContracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="rocket-pool"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us