All Reports
Download PDF
The Vault Liquid Unstaker V2
2025-11-18
Critical1
High1
Medium1
Low2
Info2
About the Protocol
Instant unstaking protocol for LSTs and native SOL stake accounts with LP-funded liquidity pools.
Findings (7)
C-01CriticalFixed
The flash_borrow instruction can be used to drain the vault
Flash loan mechanism allows complete vault drainage through improper repayment validation.
H-01HighFixed
withdraw_stake_account instruction does not assign StakeAccount authority to user
Withdrawn stake accounts retain vault authority instead of being assigned to the user.
M-01MediumFixed
withdraw_stake_account instruction may dilute vault rewards
Stake account withdrawal timing can dilute rewards for other vault participants.
L-01LowFixed
Inconsistent rent refund
Rent refund recipient is inconsistent across different instructions.
L-02LowFixed
liquid_unstake_lst instructions lack address verification
Missing address validation in unstaking instructions.
Ready to Secure Your Project?
Let's discuss your project and ensure your security!