Skip to content
Request an audit

‹ Findings database

In StakingAssetManager::lockERC20() the resulting note is created with asset instead of zkToken

Crit/HighSingularity audit·Three Sigma·Private DeFi access·26th February, 20243S-SG-C01

Description

Users can transfer tokens to the StakingAssetManager in return for a note commitment of the corresponding zkToken. However, StakingAssetManager::lockERC20() builds the note using args.asset, which is the asset itself, which will lead to problems (will not be able to unlock).

Recommendation

Build the note using zkToken instead.

Status

Addressed in #ab8b4b9.

Source

Disclosed by 0xSimao · Sherlock's 2025 Watson of the Year · 21 first places in 57 audit contests