Assessment reportsPublic findings
Back to Zellic siteBack
↗
Assessment reports>Lido Fixed Income>Threat Model>deposit
GeneralOverview
Findings
Critical (2)
High (3)
Medium (2)
Low (5)
Informational (2)
DiscussionConsider transferring stETH instead of ETHConfusing math in finalizeVaultEndedWithdrawalsPremium claim requirement ensures safety tooComment implies more centralization than existsUse batch withdrawals for gas savingsUnused event `VaultCodeSet`
Threat ModelWhat are threat models?
LidoVault.solclaimFixedPremiumdepositfinalizeVaultEndedWithdrawalsfinalizeVaultNotStartedFixedWithdrawalsfinalizeVaultOngoingFixedWithdrawalsfinalizeVaultOngoingVariableWithdrawalsgetFixedOngoingWithdrawalRequestIdsgetFixedOngoingWithdrawalRequestTimestampinitializeisEndedisStartedmaxStETHWithdrawalAmountminStETHWithdrawalAmountstakingBalancewithdraw
VaultFactory.sol
Audit ResultsSummary

Function: deposit(uint256 side)

This function divides into FIXED and VARIABLE to deposit. In FIXED, mint claim tokens and ETHDepositTokens. In VARIABLE, mint bearer tokens.

Inputs

  • side

    • Control: Arbitrary.

    • Constraints: It is expected FIXED or VARIABLE value.

    • Impact: The value of side.

Branches and code coverage

Intended branches

  • Amount is not zero.

  • isStarted() is not set.

  • Side is divided into FIXED and VARIABLE.

Negative behavior

  • Reverts if the fixedSideCapacity is zero.

  • Reverts if the !isStarted() is not zero.

  • Reverts if the side is not FIXED or VARIABLE.

  • Reverts if the msg.value is smaller than minimumDepositAmount.

  • Reverts if the amount is smaller than minimumFixedDeposit.

  • Reverts if the amount is larger than fixedSideCapacity - fixedETHDepositTokenTotalSupply.

  • Reverts if the remainingCapacity is smaller than minimumFixedDeposit and not zero.

  • Reverts if the shares is smaller than one.

  • Reverts if the stETHReceived is smaller than amount and amount - stETHReceived is larger than LIDO_ERROR_TOLERANCE_ETH.

  • Reverts if the amount is larger than variableSideCapacity - variableBearerTokenTotalSupply.

  • Reverts if the remainingCapacity is smaller than minimumDepositAmount and not zero.

Function call analysis

  • Math.mulDiv(this.fixedSideCapacity, this.minimumFixedDepositBps, 10000)

    • What is controllable? None.

    • If the return value is controllable, how is it used and how can it go wrong? None.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • this.stakingBalance() -> LidoVault.lido.balanceOf(address(this))

    • What is controllable? None.

    • If the return value is controllable, how is it used and how can it go wrong? None.

    • What happens if it reverts, reenters or does other unusual control flow? N/A.

  • LidoVault.lido.submit{value: amount}

    • What is controllable? amount.

    • If the return value is controllable, how is it used and how can it go wrong? None.

    • What happens if it reverts, reenters or does other unusual control flow? It can be misused. It is caused reentrancy.

Zellic © 2025Back to top ↑