Saffron Lido Vaults audit contest

A public audit contest on Sherlock (staking), completed on 16th September 2024. 0xSimao placed #1. 5 of his findings are published: 2 high severity and 3 medium.

What Saffron Lido Vaults is

Saffron splits a single yield source into fixed and variable legs: in the Lido vault, the fixed side deposits ETH that earns a set rate, the variable side pays that rate to capture all the staking yield above it, and the vault settles the two when the term ends.

Scope

The Lido vault: the fixed and variable sides, deposit and withdrawal ordering, and the split of staking yield between them.

High severity findings

• totalEarnings is incorrect when withdrawing after ending which will withdraw too many funds leaving the Vault insolvent
• The incorrect accounting of protocol fee will cause double charging fee and wrong distribution of earnings for variable users

Medium severity findings

• LidoVault::vaultEndedWithdraw doesn't take into consideration income withdrawals before slashing, blocking variable users from withdrwing their income
• Withdrawing after a slash event before the vault has ended will decrease fixedSidestETHOnStartCapacity by less than it should, so following users will withdraw more their initial deposit
• Attacker will DoS LidoVault up to 36 days which will ruin expected apr for all parties involved

The contest

View the contest page