Zellic - Audit Reports

Assessment reports Public findings

Back to Zellic site

Assessment reports>Polygon Staking>Threat Model>splitRewards

GeneralOverview

Findings

Informational (7)

DiscussionThe logic in _updateStrategyRewards may not need to update all the strategies The LSTRewardsSplitter's splitting is not path-independent, which may have cross-protocol implications Calling checkUpkeep on chain is against the automation documentation and may revert or waste gas

Threat ModelWhat are threat models?

LSTRewardsSplitter.sol deposit performUpkeep splitRewards withdraw

LSTRewardsSplitterController.sol PolygonFundFlowController.sol PolygonStrategy.sol PolygonVault.sol

Audit ResultsAssessment Results

Function: `splitRewards()`

This function splits rewards between fee receivers. Unlike performUpkeep, it bypasses the reward threshold.

Branches and code coverage

Intended branches

Subtract LST balance from principal deposits to get new rewards.
Test coverage
Add negative rewards, if there are any, to principal deposits.
Test coverage
Check if there are enough new rewards.
Test coverage
Split rewards otherwise.
Test coverage

Negative behavior

Revert transactions if there are not enough new rewards.
Negative test

Zellic © 2025Back to top ↑