# Symbiotic Relay audit contest Sherlock · Staking · 19th June 2025 · #1 A public audit contest on Sherlock (staking), completed on 19th June 2025. 0xSimao placed #1. 5 of his findings are published: 5 medium. ## What Symbiotic Relay is Symbiotic Core is a modular on-chain framework for building staking solutions: collateral choice across native tokens, restaked assets or multi-asset baskets, with reward, slashing and redistribution logic to match. Symbiotic Relay extends it across execution environments: an SDK and middleware layer that lets protocols on any chain lease security from stake registered in the core. ## Scope The Sherlock contest covered the middleware SDK, 73 files and 4,345 nSLOC: the relay contracts extending Symbiotic Core across execution environments, validator-set and key management, and the settlement plumbing a network integrates against. ## Medium severity findings - [Most KeyRegistry, VotingPowerProvider functions can be DoSed](https://0xsimao.com/findings/symbiotic-relay-registry-voting-power-provider) - [Changing the epoch duration will completely break the vault and the slashers](https://0xsimao.com/findings/symbiotic-relay-epoch-duration-completely-slashers) - [BlsBn254 is not available in certain chains due to hardcoded gas limit](https://0xsimao.com/findings/symbiotic-relay-bls-bn254-hardcoded-gas) - [A malicious operator will control consensus without risking stake (stake-exit lag exploit)](https://0xsimao.com/findings/symbiotic-relay-control-consensus-risking-stake) - [Malicious operator can alone, with any voting power smaller than quorum forge a proof](https://0xsimao.com/findings/symbiotic-relay-alone-voting-quorum-proof) ## The contest [View the contest page](https://audits.sherlock.xyz/contests/967)