All Reports
Download PDF
lstOlas
2025-10-21
Critical0
High4
Medium3
Low4
Info1
About the Protocol
Liquid staking protocol for OLAS tokens enabling cross-chain staking with yield-bearing stOLAS wrapper.
Findings (12)
H-01HighFixed
LzOracle contract doesn't assign any value to the depository address
Depository variable is declared but never assigned, breaking core functionality.
H-02HighFixed
Tokens cannot be retrieved back after lock period is over
Lock contract creates veOLAS locks but lacks withdrawal mechanism.
H-03HighFixed
Users able to request unstake before their stake completes in L2
Unstake requests can be submitted before L2 staking confirmation.
H-04HighFixed
Collector.sol can't set protocol fees
Protocol fee setter function has implementation error preventing fee changes.
M-01MediumFixed
Attacker can create and activate malicious staking proxies
Permissionless proxy creation allows malicious staking instances.
Ready to Secure Your Project?
Get a free 30-minute security assessment. We will review your codebase scope and flag the top 3 risk areas.
No commitment required. Typical audits start within 1–2 weeks.