Redeems Reserve Push-based approach#1756
Draft
bulbozaur wants to merge 6 commits intofeat/staking-router-3.0from
Draft
Redeems Reserve Push-based approach#1756bulbozaur wants to merge 6 commits intofeat/staking-router-3.0from
bulbozaur wants to merge 6 commits intofeat/staking-router-3.0from
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+99
to
+122
| function redeem(uint256 _stETHAmount, address _ethRecipient) external onlyRole(REDEEMER_ROLE) whenResumed { | ||
| if (_stETHAmount == 0) revert ZeroAmount(); | ||
| if (_ethRecipient == address(0)) revert ZeroRecipient(); | ||
| if (LIDO.isStopped()) revert LidoStopped(); | ||
| if (WITHDRAWAL_QUEUE.isBunkerModeActive()) revert BunkerMode(); | ||
| if (WITHDRAWAL_QUEUE.isPaused()) revert WQPaused(); | ||
|
|
||
| uint256 sharesAmount = LIDO.getSharesByPooledEth(_stETHAmount); | ||
| uint256 etherAmount = LIDO.getPooledEthByShares(sharesAmount); | ||
|
|
||
| uint256 available = _reserveBalance - _redeemedEther; | ||
| if (etherAmount > available) { | ||
| revert InsufficientReserve(etherAmount, available); | ||
| } | ||
|
|
||
| LIDO.transferSharesFrom(msg.sender, address(this), sharesAmount); | ||
| BURNER.requestBurnSharesForRedeem(address(this), sharesAmount); | ||
| _redeemedEther += etherAmount; | ||
|
|
||
| (bool success,) = _ethRecipient.call{value: etherAmount}(""); | ||
| if (!success) revert ETHTransferFailed(_ethRecipient, etherAmount); | ||
|
|
||
| emit Redeemed(msg.sender, _ethRecipient, _stETHAmount, sharesAmount, etherAmount); | ||
| } |
Check failure
Code scanning / Slither
Functions that send Ether to arbitrary destinations High
Comment on lines
+158
to
+161
| function recoverERC20(address _token, uint256 _amount) external onlyRole(DEFAULT_ADMIN_ROLE) { | ||
| if (_token == address(LIDO)) revert StETHRecoveryNotAllowed(); | ||
| IERC20(_token).transfer(msg.sender, _amount); | ||
| } |
Check failure
Code scanning / Slither
Unchecked transfer High
Comment on lines
+86
to
+90
| function initialize(address _admin) external { | ||
| _initializeContractVersionTo(1); | ||
| LIDO.approve(address(BURNER), type(uint256).max); | ||
| _grantRole(DEFAULT_ADMIN_ROLE, _admin); | ||
| } |
Check warning
Code scanning / Slither
Unused return Medium
Comment on lines
+99
to
+122
| function redeem(uint256 _stETHAmount, address _ethRecipient) external onlyRole(REDEEMER_ROLE) whenResumed { | ||
| if (_stETHAmount == 0) revert ZeroAmount(); | ||
| if (_ethRecipient == address(0)) revert ZeroRecipient(); | ||
| if (LIDO.isStopped()) revert LidoStopped(); | ||
| if (WITHDRAWAL_QUEUE.isBunkerModeActive()) revert BunkerMode(); | ||
| if (WITHDRAWAL_QUEUE.isPaused()) revert WQPaused(); | ||
|
|
||
| uint256 sharesAmount = LIDO.getSharesByPooledEth(_stETHAmount); | ||
| uint256 etherAmount = LIDO.getPooledEthByShares(sharesAmount); | ||
|
|
||
| uint256 available = _reserveBalance - _redeemedEther; | ||
| if (etherAmount > available) { | ||
| revert InsufficientReserve(etherAmount, available); | ||
| } | ||
|
|
||
| LIDO.transferSharesFrom(msg.sender, address(this), sharesAmount); | ||
| BURNER.requestBurnSharesForRedeem(address(this), sharesAmount); | ||
| _redeemedEther += etherAmount; | ||
|
|
||
| (bool success,) = _ethRecipient.call{value: etherAmount}(""); | ||
| if (!success) revert ETHTransferFailed(_ethRecipient, etherAmount); | ||
|
|
||
| emit Redeemed(msg.sender, _ethRecipient, _stETHAmount, sharesAmount, etherAmount); | ||
| } |
Check warning
Code scanning / Slither
Reentrancy vulnerabilities Medium
Comment on lines
+99
to
+122
| function redeem(uint256 _stETHAmount, address _ethRecipient) external onlyRole(REDEEMER_ROLE) whenResumed { | ||
| if (_stETHAmount == 0) revert ZeroAmount(); | ||
| if (_ethRecipient == address(0)) revert ZeroRecipient(); | ||
| if (LIDO.isStopped()) revert LidoStopped(); | ||
| if (WITHDRAWAL_QUEUE.isBunkerModeActive()) revert BunkerMode(); | ||
| if (WITHDRAWAL_QUEUE.isPaused()) revert WQPaused(); | ||
|
|
||
| uint256 sharesAmount = LIDO.getSharesByPooledEth(_stETHAmount); | ||
| uint256 etherAmount = LIDO.getPooledEthByShares(sharesAmount); | ||
|
|
||
| uint256 available = _reserveBalance - _redeemedEther; | ||
| if (etherAmount > available) { | ||
| revert InsufficientReserve(etherAmount, available); | ||
| } | ||
|
|
||
| LIDO.transferSharesFrom(msg.sender, address(this), sharesAmount); | ||
| BURNER.requestBurnSharesForRedeem(address(this), sharesAmount); | ||
| _redeemedEther += etherAmount; | ||
|
|
||
| (bool success,) = _ethRecipient.call{value: etherAmount}(""); | ||
| if (!success) revert ETHTransferFailed(_ethRecipient, etherAmount); | ||
|
|
||
| emit Redeemed(msg.sender, _ethRecipient, _stETHAmount, sharesAmount, etherAmount); | ||
| } |
Check warning
Code scanning / Slither
Unused return Medium
Comment on lines
+165
to
+170
| function recoverStETHShares() external onlyRole(DEFAULT_ADMIN_ROLE) { | ||
| uint256 shares = LIDO.sharesOf(address(this)); | ||
| if (shares > 0) { | ||
| LIDO.transferShares(msg.sender, shares); | ||
| } | ||
| } |
Check warning
Code scanning / Slither
Unused return Medium
|
Hardhat Unit Tests Coverage SummaryDetailsDiff against masterResults for commit: 13ae3e5 Minimum allowed coverage is ♻️ This comment has been updated with latest results |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Redeems reserve — governance-configurable portion of buffered ether protected from CL deposits and WQ finalization,
enabling instant stETH→ETH redemptions. Full spec.
In the push-based approach, reserve ETH is physically held in a dedicated
RedeemsBuffercontract. Shares are forwardedto Burner's isolated redeem track immediately during
redeem()and burned outside the rebase limiter on the next oraclereport.
RedeemsBuffer
OssifiableProxywithinitialize()+Versionedredeem()— transfers shares to Burner viarequestBurnSharesForRedeem, sends ETH to recipient, tracks_redeemedEtherwithdrawUnredeemed()— returns unredeemed ETH to Lido, resets counters. Gated by LidofundReserve()— accepts ETH from Lido during report pushPausableUntilfor Gate Seal compatibilitysetRedeemsBuffer(address(0))requirescurrent.balance == 0Lido
collectRewardsAndProcessWithdrawalsgains_redeemedEtherparameter, handles full ETH round-trip internally: withdrawunredeemed → reconcile → standard flow → grow reserve → push
setRedeemsReserveTargetRatiostores ratio only, no immediate reduction — deferred to next report_growRedeemsReserve()replenishes reserve toward target on each reportreceiveFromRedeemsBuffer()accepts returned ETHBurner: isolated redeem track
requestBurnSharesForRedeem— gated byREQUEST_BURN_SHARES_ROLEcommitRedeemSharesToBurn— burns all pending redeem shares unconditionally_getExcessStETHSharesincludesredeemSharesBurnRequestedgetSharesRequestedToBurnreturns(cover, nonCover, redeem)Accounting
burner.getRedeemSharesRequestedToBurn()andbuffer.getRedeemedEther()redeemedEtherfromsmoothenTokenRebasebasesmoothedSharesToBurn(limiter-constrained) andredeemSharesToBurn(unconditional) tracked separatelyredeemedEthertocollectRewardsAndProcessWithdrawals