Incident
Incident,
Source: De.Fi incident database.
- Audits before it
- 2.
- Audits since
- 1, the latest dated 15 Jun 2023.
unshETH security record
As of 3 Nov 2026, unshETH has 3 audit reports by 2 security firms on Trustblock; the latest is by Paladin, dated 15 Jun 2023. Those reports list no open critical findings. It also holds 6 deployed contracts on 1 chain and 1 incident (latest 30 May 2023).
Critical findings
No open critical findings
Across 3 reports.
Incident
Incident 30 May 2023
Source: De.Fi incident database. 1 audit has been published since. See the incident
Open the latest report
Your label, live
Get the label for your siteRecord last updated . It holds audits, findings and contracts up to Nov 2026, and incidents up to Oct 2026. Trustblock does not review code.
Audits3
Newest first
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Audit Report | Security firm: Paladin | Date: | Scope: 6 addresses on Ethereum | No open critical findings | Open · paladinsec.co |
| UnshETH #2 | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
| unshETH Protocol | Security firm: CertiK | Date: | Scope: Files named in the report | No open critical findings | Open · skynet.certik.com |
Findings44
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 2 | 1 | 4 |
| Low | 7 | 23 | 6 |
MediumLSD array logic is flawed, allowing for the first LSD to be added and enumerability to be more limited than it needs to beAudit Report · Paladin · 15 Jun 2023Open
The report gives no description here.
Open the reportMediumThe external deposit_stEth function is broken as it does not pull in any stETH from the userAudit Report · Paladin · 15 Jun 2023Open
The report gives no description here.
Open the reportLowdeposit_lsd lacks a reentrancy guardAudit Report · Paladin · 15 Jun 2023Open
The report gives no description here.
Open the reportLowShangai time safeguard is futile as it can be called repeatedlyAudit Report · Paladin · 15 Jun 2023Open
The report gives no description here.
Open the reportLowLacks Flexibility Of Updating Oracle AddressesunshETH Protocol · CertiK · 23 Mar 2023Open
Contract `Darknet` serves as the price oracle for the unshETH protocol, the address `lsd` and `fn_sig` will be set up in the deployment stage and there's no way to update in the later stage. This lacks flexibility.
Open the reportLowMissing Emit EventsunshETH Protocol · CertiK · 23 Mar 2023Open
There should always be events emitted in the sensitive functions that are controlled by centralization roles.
Open the reportLowUsage of Hardhat's ConsoleunshETH Protocol · CertiK · 23 Mar 2023Open
The contract uses the console contract from Hardhat, which is meant to be used for testing purposes.
Open the reportLowVariable could be declared as `constant`unshETH Protocol · CertiK · 23 Mar 2023Open
In the contract `EuclideanFarm.sol`, the following variables could be set to constant to save gas: ```solidity uint256 public max_cord_multiplier = uint256(3e18); uint256 public min_cord_multiplier = uint256(1e18); uint256 public max_nonce = 2; //no more than 2 changes to targetRatio ``` In the contract `LSDRegistry.sol`, the following variables could be set to constant to save gas: ```solidity uint256 public minUpdateCooldown = 21 days; //minimum number of time before ratios/tokens can be changed again uint256 public min_update_distance = 0.5e18; uint256 public max_nonce = 2; ``` These variables could be declared as `constant` since these state variables are never to be changed.
Open the reportLowVariables Can Be Declared as `Immutable`unshETH Protocol · CertiK · 23 Mar 2023Open
The following variables assigned in the constructor can be declared as `Immutable`. Immutable state variables can be assigned during contract creation but will remain constant throughout the lifetime of a deployed contract. An advantage of immutable variables is that reading them is significantly cheaper than reading from regular state variables since they are not located in storage. ```solidity address public lsdVaultAddress; // 0xE76Ffee8722c21b390eebe71b67D95602f58237F; address public unshETHAddress; //0x846982C0a47b0e9f4c13F3251ba972Bb8D32a8cA; address public wstETHAddress; //0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0; address public frxETHAddress; //0xbafa44efe7901e04e39dad13167d089c559c1138; address public sfrxETHAddress; //0xac3e018457b222d93114458476f3e3416abbe38f; address public rETHRouterAddress; //0x16D5A408e807db8eF7c578279BEeEe6b228f1c1C; address public rETHAddress; //0xae78736cd615f374d3085123a210448e74fc6393; ```
Open the reportIncidents1
Attached through a shared contract address. Our incident data ends in Oct 2026.
Contracts6
| Address | Chain | Source code |
|---|---|---|
| 0x0ae38f7e10a43b5b2fb064b42a2f4514cba909ef | Chain: Ethereum | Source code: Verified source |
| 0xc258ff338322b6852c281936d4edeff8adff23ee | Chain: Ethereum | Source code: Verified source |
| 0xb250216b5bce306fa37f7de76a82409663ed52c3 | Chain: Ethereum | Source code: Verified source |
| 0x1a890ebcd20a9fb551c0440428805bc24ef62641 | Chain: Ethereum | Source code: Verified source |
| 0x35636b85b68c1b4a216110fb3a5fb447a99db14a | Chain: Ethereum | Source code: Verified source |
| 0x51a80238b5738725128d3a3e06ab41c1d4c05c74 | Chain: Ethereum | Source code: Verified source |
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="unsheth"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us