Symbiotic Relay audit contest
A public audit contest on Sherlock (staking), completed on 19th June 2025. 0xSimao placed #1. 5 of his findings are published: 5 medium.
What Symbiotic Relay is
Symbiotic Core is a modular on-chain framework for building staking solutions: collateral choice across native tokens, restaked assets or multi-asset baskets, with reward, slashing and redistribution logic to match.
Symbiotic Relay extends it across execution environments: an SDK and middleware layer that lets protocols on any chain lease security from stake registered in the core.
Scope
The Sherlock contest covered the middleware SDK, 73 files and 4,345 nSLOC: the relay contracts extending Symbiotic Core across execution environments, validator-set and key management, and the settlement plumbing a network integrates against.
Medium severity findings
- Most KeyRegistry, VotingPowerProvider functions can be DoSed
- Changing the epoch duration will completely break the vault and the slashers
- BlsBn254 is not available in certain chains due to hardcoded gas limit
- A malicious operator will control consensus without risking stake (stake-exit lag exploit)
- Malicious operator can alone, with any voting power smaller than quorum forge a proof
The contest