# Saffron Lido Vaults audit contest Sherlock · Staking · 16th September 2024 · #1 A public audit contest on Sherlock (staking), completed on 16th September 2024. 0xSimao placed #1. 5 of his findings are published: 2 high severity and 3 medium. ## What Saffron Lido Vaults is Saffron splits a single yield source into fixed and variable legs: in the Lido vault, the fixed side deposits ETH that earns a set rate, the variable side pays that rate to capture all the staking yield above it, and the vault settles the two when the term ends. ## Scope The Lido vault: the fixed and variable sides, deposit and withdrawal ordering, and the split of staking yield between them. ## High severity findings - [`totalEarnings` is incorrect when withdrawing after ending which will withdraw too many funds leaving the `Vault` insolvent](https://0xsimao.com/findings/saffron-lido-vaults-ending-withdraw-leaving-insolvent) - [The incorrect accounting of protocol fee will cause double charging fee and wrong distribution of earnings for variable users](https://0xsimao.com/findings/saffron-lido-vaults-accounting-fee-double-charging) ## Medium severity findings - [`LidoVault::vaultEndedWithdraw` doesn't take into consideration income withdrawals before slashing, blocking variable users from withdrwing their income](https://0xsimao.com/findings/saffron-lido-vaults-withdraw-withdrawals-slashing-withdrwing) - [Withdrawing after a slash event before the vault has ended will decrease `fixedSidestETHOnStartCapacity` by less than it should, so following users will withdraw more their initial deposit](https://0xsimao.com/findings/saffron-lido-vaults-slash-eth-withdraw-deposit) - [Attacker will DoS `LidoVault` up to 36 days which will ruin expected apr for all parties involved](https://0xsimao.com/findings/saffron-lido-vaults-lido-ruin-parties-involved) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/509)