{
  "id": 15978798,
  "title": "Security Audit Report: Reentrancy & Access Control Review: Rocket Pool",
  "url": "https://urgent.news/2026/10/22/security-audit-report-reentrancy-access-control-review-rocket-pool",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-22T00:54:10.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dannydoes_2abdf9c/security-audit-report-reentrancy-access-control-review-rocket-pool-494b"
  },
  "original_language": "en",
  "account": "In the security audit report for the Rocket Pool protocol, researchers identified several critical issues related to reentrancy and access control in the core contracts. The protocol's primary contracts handle node-operator registration, staking pool accounting, reward distribution, governance, and admin functions. Given the substantial assets under management ($1 B) and the protocol's interconnectivity with other DeFi primitives, the security of its reentrancy and access-control mechanisms is of utmost importance.\n\nThe audit focused on the latest main-net deployment (v1.3.0) and the corresponding L2 adapters for Ethereum and L2 networks. The analysis covered twelve thousand lines of core staking code, nine thousand lines of reward and withdrawal logic, and three thousand lines of L2 bridge implementation.\n\nThe report highlights three critical reentrancy vulnerabilities:\n\n1. In RocketMinipool's withdraw function, no nonReentrant modifier is applied, allowing an attacker-controlled contract to extract ETH multiple times by receiving the funds in the fallback function, potentially leading to the complete loss of the minipool balance.\n\n2. RocketDepositPool's deposit function forwards ETH to RocketNodeManager without updating totalDeposits before the external call. This oversight enables a malicious RocketNodeManager implementation to manipulate the deposit count, causing inaccurate Total Value Locked (TVL) reporting and reward allocation.\n\n3. RocketL2Bridge's finalizeWithdrawal function transfers ERC20 tokens without a reentrancy guard, making it susceptible to an attacker-controlled malicious token triggering multiple transfers for the same L2 withdrawal.\n\nRegarding access control weaknesses, seven critical issues were identified:\n\n1. RocketDAOProtocolSettings' setProtocolDao function lacks an owner check, enabling any address to alter the DAO address and potentially redirect control to a malicious contract.\n\n2. RocketDAOProposal's execute function does not verify the target address, allowing arbitrary contract calls with any data, which could lead to arbitrary code execution or fund theft.\n\n3. RocketNodeManager's addNodeOperator function only checks if msg.sender equals protocolDao, leaving the contract open to takeover by a compromised DAO executor.\n\n4. RocketMinipoolQueue has no access restrictions, making it susceptible to DoS attacks and spamming the protocol with malicious minipool contracts.\n\n5. RocketL2Bridge's setBridgeOperator function is callable by the owner only, but in the constructor, the owner is set to msg.sender, lacking a timelocked governance contract for enhanced security.\n\n6. RocketTokenRETH's mint function grants the minting role to RocketDAOProtocolSettings, which is upgradeable via an unprotected upgradeTo function. This allows an attacker to inflate the rETH supply and dilute token holders.\n\n7. RocketDAOProtocolSettingsNetwork's setNetworkParameters function has no access restrictions, leaving the network parameters vulnerable to manipulation by an attacker.\n\nThe overall risk score for the protocol is 7.4 out of 10, classified as \"High\". The most severe issues stem from missing non-reentrant guards and over-privileged admin functions that can be exploited by compromised DAO executors. The audit provides detailed remediation steps for each identified vulnerability, aiming to enhance the security and reliability of the Rocket Pool protocol.",
  "summary": "Security Audit Report: Reentrancy & Access Control Review: Rocket Pool Target Protocol : Rocket Pool (TVL: $1277.3M) Security Audit Report – Reentrancy & Access‑Control Review Protocol: Rocket Pool (Ethereum & L2s) – TVL ≈ $1.277 B Audit Window: 2024‑10‑01 – 2024‑10‑15 Prepared By: [Your Company / Team] – Senior DeFi Security Researchers Date: 2024‑10‑22 1. Executive Summary Rocket Pool is a…",
  "key_points": [
    "Rocket Pool protocol audit reveals three reentrancy vulnerabilities in core contracts",
    "Overall risk score classified as High due to exploitable admin functions and supply inflation risks"
  ],
  "editors_take": "These critical vulnerabilities in reentrancy guards and administrative permissions expose the protocol to massive fund theft and governance takeover, threatening the security of its substantial assets under management.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}