Blockdaemon Staking API - Ethereum Security Audit Certificate
📑 Blockdaemon Deposit Contract - Audit Certificate
Executive Summary
- Type: Validator Deposit Contract
- Auditors: Guillermo Escobero, Martinet Lee, Zeeshan Meghji
- Timeline: 2022-10-04 through 2022-10-05
- Languages: Solidity
- Methods: Architecture Review, Unit Testing, Computer-Aided Verification, Manual Review
- Specification: Staking API Documentation
- Total Issues: 6 (4 Resolved)
Risk Assessment
- High Risk Issues: 0 (0 Resolved)
- Medium Risk Issues: 0 (0 Resolved)
- Low Risk Issues: 2 (1 Resolved)
- Informational Risk Issues: 4 (3 Resolved)
Summary of Findings
Quantstamp audited the smart contract proposed by Blockdaemon for performing batch deposits. The documentation provided does not adequately cover the smart contract, and we recommend improving it by creating a dedicated page explaining the different parameters involved.
Adherence to Best Practices
| Update ID | Description | Severity | Status |
|---|---|---|---|
| QSP-1 | validUntil Can Be Modified Arbitrarily | Low | Acknowledged |
| QSP-2 | Missing Input Validation | Low | Fixed |
| QSP-3 | Incorrect/Missing Visibility | Informational | Fixed |
| QSP-4 | Application Monitoring Can Be Improved by Emitting Events | Informational | Acknowledged |
| QSP-5 | BatchDeposit.depositBatch() Could Run Out of Gas | Informational | Mitigated |
| QSP-6 | Hard for Users to Check Whether the depositContract Is Correctly Set | Informational | Fixed |
Auditor Suggestions
- QSP-1: Explore adding a signature for validUntil to avoid unauthorized modifications.
- QSP-2: Ensure all relevant checks for input validation are included.
- QSP-3: Explicitly declare visibility for constants.
- QSP-4: It is advisable to emit events for important state transitions.
Methodology
- 1. Code Review: Review specifications and manual inspection of source code for vulnerabilities.
- 2. Testing and Automated Analysis: Includes test coverage analysis and symbolic execution of the program.
- 3. Best Practices Review: Evaluate design, maintainability, and security against documented standards.
📑 Blockdaemon Deposit Contract - Audit Certificate (Post-Pectra)
Executive Summary
- Type: ETH 2.0 Staking
- Timeline: 2025-02-19 through 2025-02-24
- Languages: Solidity
- Total Findings: 2 Fixed: 2
Summary of Findings
Blockdaemon has introduced a new batchDeposit() function to enhance efficiency. An identified security risk could lead to a Denial-of-Service condition, preventing future deposits.
Assessment Breakdown
| ID | Description | Severity | Status |
|---|---|---|---|
| BLO-1 | Forcing Ether Into the Contract Creates Denial-of-Service Vector | Medium | Fixed |
| BLO-2 | Out-of-Bounds Write/Data Overwrite via Permissive Length Check | Medium | Fixed |
Findings
- BLO-1: The check for ensuring zero balance can lead to a DoS attack. Recommendation to modify this logic.
- BLO-2: Permissive length checking may lead to overwriting deposit details, hence a recommendation for stricter checks.
Methodology
- Same as above.
The audit focuses exclusively on specific repository features as of the commit hashes outlined and does not account for future enhancements or modifications.