Zellic - Audit Reports

Assessment reports>Lido Fixed Income>Discussion>Unused event `VaultCodeSet`

Findings

DiscussionConsider transferring stETH instead of ETH Confusing math in finalizeVaultEndedWithdrawals Premium claim requirement ensures safety too Comment implies more centralization than exists Use batch withdrawals for gas savings Unused event `VaultCodeSet`

Threat ModelWhat are threat models?LidoVault.sol VaultFactory.sol

Audit ResultsSummary

Unused event `VaultCodeSet`

In VaultFactory, the VaultCodeSet event is defined; however, it is never emitted.

contract VaultFactory is ILidoVaultInitializer {
  // [...]

  /// @notice Emitted when the vault bytecode is set
  /// @param creator Address of creator
  event VaultCodeSet(address indexed creator);

We recommend emitting this event at the appropriate time or removing this event definition.

This issue has been acknowledged by Saffron, and a fix was implemented in commit 0cdbc3d1↗.

Unused event VaultCodeSet

Unused event `VaultCodeSet`