Skip to content

[VAULTS] Various audit fixes #1489

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 8 commits into from
Oct 4, 2025
Merged

[VAULTS] Various audit fixes #1489

merged 8 commits into from
Oct 4, 2025

Conversation

@folkyatina
Copy link
Member

@folkyatina folkyatina commented Sep 30, 2025

No description provided.

@github-actions
Copy link

github-actions bot commented Sep 30, 2025 •
edited
Loading

badge

Hardhat Unit Tests Coverage Summary

Filename                                                                Stmts    Miss  Cover    Missing
--------------------------------------------------------------------  -------  ------  -------  -----------------------------------------------------------------------------------------------------
contracts/0.4.24/Lido.sol                                                 278      11  96.04%   809-828, 924-936
contracts/0.4.24/StETH.sol                                                 80       0  100.00%
contracts/0.4.24/StETHPermit.sol                                           15       0  100.00%
contracts/0.4.24/lib/Packed64x4.sol                                         5       0  100.00%
contracts/0.4.24/lib/SigningKeys.sol                                       36       0  100.00%
contracts/0.4.24/lib/StakeLimitUtils.sol                                   41       0  100.00%
contracts/0.4.24/nos/NodeOperatorsRegistry.sol                            436       0  100.00%
contracts/0.4.24/utils/Pausable.sol                                         9       0  100.00%
contracts/0.4.24/utils/UnstructuredStorageExt.sol                          14       0  100.00%
contracts/0.4.24/utils/Versioned.sol                                        5       0  100.00%
contracts/0.6.12/WstETH.sol                                                17       0  100.00%
contracts/0.8.25/ValidatorExitDelayVerifier.sol                            75       0  100.00%
contracts/0.8.25/utils/AccessControlConfirmable.sol                         2       0  100.00%
contracts/0.8.25/utils/Confirmable2Addresses.sol                            5       0  100.00%
contracts/0.8.25/utils/Confirmations.sol                                   37       0  100.00%
contracts/0.8.25/utils/PausableUntilWithRoles.sol                           3       0  100.00%
contracts/0.8.25/utils/V3TemporaryAdmin.sol                                52      52  0.00%    83-218
contracts/0.8.25/vaults/LazyOracle.sol                                    120      13  89.17%   221, 270-273, 399, 411, 427, 474, 514-516, 591, 599
contracts/0.8.25/vaults/OperatorGrid.sol                                  189       0  100.00%
contracts/0.8.25/vaults/PinnedBeaconProxy.sol                               6       0  100.00%
contracts/0.8.25/vaults/StakingVault.sol                                  111      14  87.39%   307-341
contracts/0.8.25/vaults/ValidatorConsolidationRequests.sol                 48       3  93.75%   183, 187, 199
contracts/0.8.25/vaults/VaultFactory.sol                                   35       0  100.00%
contracts/0.8.25/vaults/VaultHub.sol                                      414      80  80.68%   250-259, 274-280, 335-356, 373, 458, 536-537, 579-672, 969-971, 1055-1061, 1115, 1170-1177, 1463-1481
contracts/0.8.25/vaults/dashboard/Dashboard.sol                           120       7  94.17%   177-195, 587-600
contracts/0.8.25/vaults/dashboard/NodeOperatorFee.sol                      64       0  100.00%
contracts/0.8.25/vaults/dashboard/Permissions.sol                          48       2  95.83%   339-348
contracts/0.8.25/vaults/interfaces/IPinnedBeaconProxy.sol                   0       0  100.00%
contracts/0.8.25/vaults/interfaces/IPredepositGuarantee.sol                 0       0  100.00%
contracts/0.8.25/vaults/interfaces/IStakingVault.sol                        0       0  100.00%
contracts/0.8.25/vaults/interfaces/IVaultFactory.sol                        0       0  100.00%
contracts/0.8.25/vaults/lib/PinnedBeaconUtils.sol                           5       0  100.00%
contracts/0.8.25/vaults/lib/RecoverTokens.sol                               5       0  100.00%
contracts/0.8.25/vaults/lib/RefSlotCache.sol                               36       0  100.00%
contracts/0.8.25/vaults/predeposit_guarantee/CLProofVerifier.sol           16       1  93.75%   214
contracts/0.8.25/vaults/predeposit_guarantee/MeIfNobodyElse.sol             3       0  100.00%
contracts/0.8.25/vaults/predeposit_guarantee/PredepositGuarantee.sol      212      12  94.34%   449-469, 502, 639, 646, 668
contracts/0.8.9/Accounting.sol                                             93       2  97.85%   342-343
contracts/0.8.9/BeaconChainDepositor.sol                                   21       2  90.48%   48, 51
contracts/0.8.9/Burner.sol                                                 92       0  100.00%
contracts/0.8.9/DepositSecurityModule.sol                                 128       0  100.00%
contracts/0.8.9/EIP712StETH.sol                                            16       0  100.00%
contracts/0.8.9/LidoExecutionLayerRewardsVault.sol                         16       0  100.00%
contracts/0.8.9/LidoLocator.sol                                            26       0  100.00%
contracts/0.8.9/OracleDaemonConfig.sol                                     28       0  100.00%
contracts/0.8.9/StakingRouter.sol                                         305       0  100.00%
contracts/0.8.9/TriggerableWithdrawalsGateway.sol                          54       1  98.15%   271
contracts/0.8.9/WithdrawalQueue.sol                                        88       0  100.00%
contracts/0.8.9/WithdrawalQueueBase.sol                                   146       0  100.00%
contracts/0.8.9/WithdrawalQueueERC721.sol                                  89       0  100.00%
contracts/0.8.9/WithdrawalVault.sol                                        32       0  100.00%
contracts/0.8.9/WithdrawalVaultEIP7002.sol                                 21       0  100.00%
contracts/0.8.9/lib/ExitLimitUtils.sol                                     35       0  100.00%
contracts/0.8.9/lib/Math.sol                                                4       0  100.00%
contracts/0.8.9/lib/PositiveTokenRebaseLimiter.sol                         22       0  100.00%
contracts/0.8.9/lib/UnstructuredRefStorage.sol                              2       0  100.00%
contracts/0.8.9/oracle/AccountingOracle.sol                               173       0  100.00%
contracts/0.8.9/oracle/BaseOracle.sol                                      89       1  98.88%   401
contracts/0.8.9/oracle/HashConsensus.sol                                  263       1  99.62%   1005
contracts/0.8.9/oracle/ValidatorsExitBus.sol                              138      10  92.75%   458-471, 541
contracts/0.8.9/oracle/ValidatorsExitBusOracle.sol                         52       1  98.08%   217
contracts/0.8.9/proxy/OssifiableProxy.sol                                  17       0  100.00%
contracts/0.8.9/proxy/WithdrawalsManagerProxy.sol                          60       0  100.00%
contracts/0.8.9/sanity_checks/OracleReportSanityChecker.sol               232      12  94.83%   307-309, 600-605, 800-835, 956
contracts/0.8.9/utils/DummyEmptyContract.sol                                0       0  100.00%
contracts/0.8.9/utils/PausableUntil.sol                                    31       0  100.00%
contracts/0.8.9/utils/Versioned.sol                                        11       0  100.00%
contracts/0.8.9/utils/access/AccessControl.sol                             23       0  100.00%
contracts/0.8.9/utils/access/AccessControlEnumerable.sol                    9       0  100.00%
contracts/common/utils/PausableUntil.sol                                   29       0  100.00%
TOTAL                                                                    4887     225  95.40%

Diff against master

Filename                                                                Stmts    Miss  Cover
--------------------------------------------------------------------  -------  ------  --------
contracts/0.4.24/Lido.sol                                                 +66     +11  -3.96%
contracts/0.4.24/StETH.sol                                                 +8       0  +100.00%
contracts/0.4.24/lib/StakeLimitUtils.sol                                   +4       0  +100.00%
contracts/0.4.24/nos/NodeOperatorsRegistry.sol                            -76       0  +100.00%
contracts/0.4.24/utils/UnstructuredStorageExt.sol                         +14       0  +100.00%
contracts/0.8.25/ValidatorExitDelayVerifier.sol                           +75       0  +100.00%
contracts/0.8.25/utils/AccessControlConfirmable.sol                        +2       0  +100.00%
contracts/0.8.25/utils/Confirmable2Addresses.sol                           +5       0  +100.00%
contracts/0.8.25/utils/Confirmations.sol                                  +37       0  +100.00%
contracts/0.8.25/utils/PausableUntilWithRoles.sol                          +3       0  +100.00%
contracts/0.8.25/utils/V3TemporaryAdmin.sol                               +52     +52  +100.00%
contracts/0.8.25/vaults/LazyOracle.sol                                   +120     +13  +89.17%
contracts/0.8.25/vaults/OperatorGrid.sol                                 +189       0  +100.00%
contracts/0.8.25/vaults/PinnedBeaconProxy.sol                              +6       0  +100.00%
contracts/0.8.25/vaults/StakingVault.sol                                 +111     +14  +87.39%
contracts/0.8.25/vaults/ValidatorConsolidationRequests.sol                +48      +3  +93.75%
contracts/0.8.25/vaults/VaultFactory.sol                                  +35       0  +100.00%
contracts/0.8.25/vaults/VaultHub.sol                                     +414     +80  +80.68%
contracts/0.8.25/vaults/dashboard/Dashboard.sol                          +120      +7  +94.17%
contracts/0.8.25/vaults/dashboard/NodeOperatorFee.sol                     +64       0  +100.00%
contracts/0.8.25/vaults/dashboard/Permissions.sol                         +48      +2  +95.83%
contracts/0.8.25/vaults/interfaces/IPinnedBeaconProxy.sol                   0       0  +100.00%
contracts/0.8.25/vaults/interfaces/IPredepositGuarantee.sol                 0       0  +100.00%
contracts/0.8.25/vaults/interfaces/IStakingVault.sol                        0       0  +100.00%
contracts/0.8.25/vaults/interfaces/IVaultFactory.sol                        0       0  +100.00%
contracts/0.8.25/vaults/lib/PinnedBeaconUtils.sol                          +5       0  +100.00%
contracts/0.8.25/vaults/lib/RecoverTokens.sol                              +5       0  +100.00%
contracts/0.8.25/vaults/lib/RefSlotCache.sol                              +36       0  +100.00%
contracts/0.8.25/vaults/predeposit_guarantee/CLProofVerifier.sol          +16      +1  +93.75%
contracts/0.8.25/vaults/predeposit_guarantee/MeIfNobodyElse.sol            +3       0  +100.00%
contracts/0.8.25/vaults/predeposit_guarantee/PredepositGuarantee.sol     +212     +12  +94.34%
contracts/0.8.9/Accounting.sol                                            +93      +2  +97.85%
contracts/0.8.9/Burner.sol                                                +21       0  +100.00%
contracts/0.8.9/LidoLocator.sol                                            +8       0  +100.00%
contracts/0.8.9/StakingRouter.sol                                         -11       0  +100.00%
contracts/0.8.9/TriggerableWithdrawalsGateway.sol                         +54      +1  +98.15%
contracts/0.8.9/WithdrawalVault.sol                                       +11       0  +100.00%
contracts/0.8.9/WithdrawalVaultEIP7002.sol                                +21       0  +100.00%
contracts/0.8.9/lib/ExitLimitUtils.sol                                    +35       0  +100.00%
contracts/0.8.9/oracle/AccountingOracle.sol                               -17      -2  +1.05%
contracts/0.8.9/oracle/ValidatorsExitBus.sol                             +138     +10  +92.75%
contracts/0.8.9/oracle/ValidatorsExitBusOracle.sol                        -39      -1  +0.28%
contracts/0.8.9/proxy/WithdrawalsManagerProxy.sol                         +60       0  +100.00%
contracts/0.8.9/sanity_checks/OracleReportSanityChecker.sol                 0     +12  -5.17%
contracts/common/utils/PausableUntil.sol                                  +29       0  +100.00%
TOTAL                                                                   +2025    +217  -3.64%

Results for commit: 92a32d7

Minimum allowed coverage is 80%

♻️ This comment has been updated with latest results

TheDZhon
TheDZhon approved these changes Oct 1, 2025
View reviewed changes
Copy link
Contributor

@TheDZhon TheDZhon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

GG 👍

@folkyatina folkyatina changed the title [VAULTS] VaultHub audit fixes [VAULTS] Various audit fixes Oct 1, 2025
This was linked to issues Oct 2, 2025
[Bug]: missing check that the owner of the stakingVault it the msg.sender when connecting vault #1469
Closed
[Enhancement]: Unsafe type casting #1329
Closed
TheDZhon
TheDZhon approved these changes Oct 3, 2025
View reviewed changes
Copy link
Contributor

@TheDZhon TheDZhon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@folkyatina folkyatina marked this pull request as ready for review October 4, 2025 08:00
@folkyatina folkyatina requested a review from a team as a code owner October 4, 2025 08:00
@folkyatina folkyatina merged commit 2ec78d2 into feat/audit-5 Oct 4, 2025
13 checks passed
@folkyatina folkyatina deleted the fix/vaulthub-polish branch October 4, 2025 08:00
@tamtamchik tamtamchik added audit Issue comes as a result of an external audit vaults Lido stVaults related changes labels Nov 10, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@TheDZhon TheDZhon TheDZhon approved these changes

Assignees

No one assigned

Labels

audit Issue comes as a result of an external audit vaults Lido stVaults related changes

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

[Bug]: missing check that the owner of the stakingVault it the msg.sender when connecting vault [Enhancement]: Unsafe type casting

4 participants

@folkyatina @TheDZhon @tamtamchik