MetaZero Staking audit
A private security review of Metazero (omnichain RWA tokenisation), conducted with Three Sigma and completed on 6th April 2024 over 3 days. 0xSimao disclosed 10 findings: 2 high severity, 3 low and 5 informational.
What Metazero is
MetaZero is a synthetic liquidity layer for omnichain tokenisation of gaming real-world assets, powered by LayerZero. Its staking contract has MetaZero tokens staked for reward emissions.
Scope
The second Three Sigma round covered the staking contract: when reward accumulation starts, how partial unstakes settle, and whether the yield curve pays out what the emission schedule promises.
High severity findings
- feesAccrued or staker principal may be sent as rewards if rewardRate and emissionEnd are not properly calculated
- Increasing emissionEnd after the previous emissionEnd ended will yield full rewards according to newEmissionEnd - prevEmissionEnd
Low severity findings
- getRemainingUnstakeTime() returns 0 if user has not unstaked
- emissionStart has no effect, rewards will start accumulating starting on the first staker
- Missing some events
Informational findings
- Variables should be cached to memory to save gas
- Custom errors should be used instead of require() statements to save gas
- completeUnstake() not following checks-effects-interactions pattern
- Constants should not be hardcoded
- Codebase is not using SafeERC20
The report