Staked eBTC
Zealynx audited Staked eBTC, BadgerDAO's BTC-collateralized yield-bearing vault that issues stEBTC against deposited eBTC. The 1-week review of 701 nSLOC of Solidity covered the reward cycle accounting, permit-based deposit flow, fee logic, and admin sweep paths. The audit identified 6 issues including 1 Medium-severity precision loss in the reward cycle end computation, 3 Low-severity issues across event emission, permit failure handling and minting fee design, and 2 Informational style and naming notes.
Scope
1 file · 701 SLOCFindings
click any row for the full write-upKey Findings
- Precision loss in
_cycleEndcalculation. ThepreviewSyncRewards()function computes_cycleEndusing division and multiplication on integers, which loses precision and yields reward cycles that drift from the expected interval. Reward distribution is consequently smaller than intended. - Missing event emission in
sweep(). The unauthorized-donation sweep path completes silently, leaving off-chain indexers and integrators with no on-chain trace of the transfer. Recommendation is to emit aSwept(token, amount)event. - Empty catch block in
depositWithSignature(). The permit failure path catches the revert and continues without checking allowance, so a front-run permit followed by an under-allowance reverts later in the deposit, wasting gas. Recommendation is to check the allowance inside the catch and revert with a clearInsufficientAllowanceerror. - Minting fee penalises legitimate users. The proposed minting fee designed to deter Protocol Yield Splitting (PYS) gaming hits all users uniformly, including long-term holders. A blacklist of identified gaming addresses is recommended as a more targeted alternative, or as a precursor to fee deployment.
Team & approval
Disclaimer
This audit is not an endorsement and does not constitute investment advice. Zealynx reviewed the codebase at the commits listed in section 02 over the engagement window. Findings are limited to issues identified within that scope and do not preclude the existence of other vulnerabilities. Subsequent code changes are not covered by this report unless the engagement is explicitly extended.
