Swell ETH Staking Deposit Bot
About the Protocol
Off-chain CLI tool that deposits Swell node-operator validators for swETH and rswETH on Ethereum mainnet.
Findings (12)
Deposit front-run of an aged key captures 32 ETH to an operator credential
A malicious operator can pre-deposit 1 ETH under their own withdrawal credential before the bot's 32 ETH top-up, permanently capturing the pooled deposit.
A single BLS-invalid front-of-queue key can halt allocated node-operator deposits
One node operator's unverifiable key blocks the entire batch, halting deposits for every operator selected in that run.
Nonce read at latest not pending causes nonce collision on an in-flight transaction
Reading the nonce at latest instead of pending can collide with an in-flight transaction and get the re-run rejected.
Duplicate operator name silently shadows an operator
Two operators sharing the same name silently overwrite each other in the allocation maps, zeroing one operator's deposits.
No gate checks the operator enabled flag
The bot never checks the on-chain enabled flag, so a disabled operator's key passes every gate and only reverts at simulation.
Ready to secure your project?
Get a free 30-minute security assessment. We’ll review your codebase scope and flag the top 3 risk areas.
No commitment required · Typical audits start within 1–2 weeks