Security Audit Report: Reentrancy & Access Control Review: Binance staked ETH
Security Audit Report: Reentrancy & Access Control Review: Binance staked ETH Target Protocol : Binance staked ETH (TVL: $9023.0M) Security Audit Report – Reentrancy & Access‑Control Review Protocol: Binance Staked ETH (BETH) TVL: ≈ $9.0 B (Ethereum + L2) Date: 15 Oct 2026 Prepared by: [Your Name] – Senior DeFi Security Researcher & Smart‑Contract Auditor 1. Executive Summary Binance Staked ETH…
Binance staked ETH (BETH) is a custodial liquid-staking wrapper that enables users to earn ETH-2.0 staking rewards while maintaining ERC-20 liquidity. The system comprises three on-chain components: a Staking Manager, the BETH Token, and a Governance & Admin contract. The audit focused on reentrancy and access control vulnerabilities across these contracts.
Key findings include:
1. Potential reentrancy in the redeem() and claimRewards() functions due to external calls before state updates.
2. Overprivileged owner role (single key) with missing multi-sig for critical functions like fee adjustments, pause, and upgrade capabilities.
3. Direct ETH transfer calls without checks-effects-interactions, leading to inconsistent states if the recipient contract reverts or consumes gas.
4. Missing events on critical state changes (e.g., fee updates), reducing transparency and on-chain analytics capabilities.
The combined risk is rated as 9/10, given the $9 billion worth of staked assets under BETH. The primary recommendation is to apply the Checks-Effects-Interactions pattern to external calls, moving state updates (burns, balance changes) before any calls or transfers. This would eliminate reentrancy windows in vulnerable functions.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
