Skip to content
$1,000,000 in security audit grants are live now, Apply here →
Get a quote

Security review · February 2025

Pre-Deposit Vault

for Ethereal

Ethereal engaged Guardian to review the security of their pre-deposit vault. From the 3rd of February to the 7th of February, a team of 7 auditors reviewed the source code in scope.

Get a quote Read the full report
Published
Review window
February 3 to 7, 2025
Language
Solidity
Chains
Ethereum, Converge, Offchain
Sector
Perpetuals
  • 0 Critical
  • 0 High
  • 0 Medium
  • 1 Low
  • 0 Informational

1 acknowledged

Scope

Overview

Ethereal engaged Guardian to review the security of their pre-deposit vault. From the 3rd of February to the 7th of February, a team of 7 auditors reviewed the source code in scope.

Findings 1

  1. L-01 Low Dead Shares Improvement Suggestion Acknowledged
    Location
    EtherealPreDepositVault.sol

    Description

    The Ethereal team has elected to use the default decimalsOffset of the OpenZeppelin ERC4626 contract of 0 instead of utilizing the decimalsOffset to reduce the risk of the first depositor inflation attack.

    The team has indicated that they will perform a sizable initial deposit upon deployment to avoid the risk of an inflation attack.

    While this addresses the issue, the constructor logic of the EtherealPreDepositVault could be modified to include this initial deposit and mint it to the dead address. This approach solves two things.

    Firstly, it guarantees that the first deposit happens in the same transaction as deployment, making it impossible to carry out the inflation attack on this first deposit.

    Secondly, it ensures that the vault can never drop to a risky level of deposits in the future, since this base amount is allocated to the dead address.

    Recommendation

    Consider implementing the initial share mint to the dead address in the constructor of the vault contract.

    Resolution

    Ethereal Team: Acknowledged.

    Link to L-01

More from Ethereal

  1. Contract Updates

     59 findings5 high 59 findings: 5 high, 4 medium, 22 low, 28 informational

  2. Orderbook DEX, Round 2

     45 findings1 critical · 5 high 45 findings: 1 critical, 5 high, 16 medium, 9 low, 14 informational

  3. Orderbook DEX

     36 findings1 critical · 1 high 36 findings: 1 critical, 1 high, 3 medium, 16 low, 15 informational

Put your code through the same review.

This review started with a conversation about scope. Tell us what you are building and we will plan yours with you.

Get a quote