Skip to content
Request an audit

‹ Findings database

MerkleRoot is not validated in all StakingAssetManager functions

Crit/HighSingularity audit·Three Sigma·Private DeFi access·26th February, 20243S-SG-C02

Description

All functions that require a merkle root to verify note inclusion must validate that the merkle root is valid. Otherwise, attackers can forge a merkle root that includes a fake note and steal all assets.

Recommendation

Validate that the provided Merkle Root is valid.

Status

Addressed in #5520165.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests