Calling Huff code auditors

Hello! So Ramana.eth has been so kind as to push forward on an idle thought of mine, essentially engineering a low gas smart contract to batch ETH->rETH mints and stETH->rETH swaps on L1. My thesis is that reducing gas costs for rocket pool aligned individuals means more rETH created, and more stETH burned. Ultimately the plan is to make it a public good, if successful.

Contract specifications:

I asked Ramana to craft a contract that had 2 basic functions:

  1. accept up to 1.0 stETH or ETH and send back rETH based on the current rETH/ETH ratio
  2. drain the stETH and ETH balances into one specified address

The order of priorities for the contract are:

  1. Trustlessness for stakers (ie, depositing stETH or ETH always gets you the appropriate rETH, or reverts)
  2. Security of honeypot (deposited assets can only be drained to a single specified address)
  3. Gas efficiency (bare bones simplicity to lower gas costs for end users)

I’m looking for people who are literate in Huff to look through the code. The bug bounty is not great (my discretion, probably something like 0.5-1 ETH for fatal bug [ways to empty either user or smart contract funds], 0.1-0.3 for griefing or sub-maximal theft exploits, and 0.01-0.1 for implemented improvements in gas efficiency), but the code isn’t complex and the amount at risk is small.

Contract documents:

Huff contract:
contracts/epineph/src/Contract.huff at main · xrchz/contracts · GitHub

launched Goerli contract:

API that we used:
[{“name”: “Deposit”, “inputs”: [{“name”: “who”, “type”: “address”, “indexed”: true}, {“name”: “stETH”, “type”: “uint256”, “indexed”: false}, {“name”: “ETH”, “type”: “uint256”, “indexed”: false}, {“name”: “rETH”, “type”: “uint256”, “indexed”: false}], “anonymous”: false, “type”: “event”}, {“name”: “Drain”, “inputs”: [{“name”: “who”, “type”: “address”, “indexed”: true}, {“name”: “to”, “type”: “address”, “indexed”: true}, {“name”: “stETH”, “type”: “uint256”, “indexed”: false}, {“name”: “ETH”, “type”: “uint256”, “indexed”: false}], “anonymous”: false, “type”: “event”}, {“stateMutability”: “nonpayable”, “type”: “constructor”, “inputs”: [{“name”: “_rocketStorage”, “type”: “address”}, {“name”: “_stETH”, “type”: “address”}, {“name”: “_owner”, “type”: “address”}], “outputs”: []}, {“stateMutability”: “payable”, “type”: “function”, “name”: “deposit”, “inputs”: [{“name”: “stETH”, “type”: “uint256”}], “outputs”: []}, {“stateMutability”: “payable”, “type”: “function”, “name”: “depositETH”, “inputs”: [], “outputs”: []}, {“stateMutability”: “nonpayable”, “type”: “function”, “name”: “depositStETH”, “inputs”: [{“name”: “stETH”, “type”: “uint256”}], “outputs”: []}, {“stateMutability”: “nonpayable”, “type”: “function”, “name”: “drain”, “inputs”: [], “outputs”: []}]

Test scenario transactions:

Deposit 0 ETH, 0 stETH
Success: 0xa9a8dd4a92969b35df61f512bfda0657fa038ec0b483af7ff0f309118d132bf2

Deposit 0.1 ETH, 0 stETH
Success: 0xb1eacf28c9dda22b1d5ca574b19f2faa60c1bbba3893b125bf3d716dec36dff4

Deposit 0.11 ETH, 0.10 stETH
Success: 0xd2855daed959545d817223b07aab93517021b4c844ed1434824e18d7a7ac0f1e

Deposit 0 ETH, 0.11 stETH
Success: 0xb6788a0cdf403c061f5d21f1e6b6a7988bc1cf973265aab2f178a22c718f7fbe

Deposit 1.1 ETH, 0.12 stETH
Revert: 0xf95a27af421fbf964db5ae610ac52a9faabca60d8655bb3bc4ccb202c9f60493

Deposit 0.12 ETH, 1.1 stETH
Revert: 0xd1fe1e1cc5bb5f400e425e65e133c0391354d23daebdbfcd2af1bc44aa256549

DepositEth 0.13 ETH
Success: 0x08508be6e6ceb29b7e8b5d4e7b5547a0440b4c840bb457b7ae8e8932b1034c14

DepositEth 0 ETH
Success: 0xb942a2681a133796ce19bcbb9ace254a62f3d8f2970fe3609b3f13e1301db7e5

DepositEth 1.2 ETH
Revert: 0x51eb2e2e46d6587842d56970733ff9a8227079623d02c204eabaa80b2db4cb92

DepositStETH 0 stETH
Success: 0x1a8c7f7a5394163a533612e30edd7b5039bb805a78034dcc53f977314de8bd98

DepositStETH 0.13 stETH
Success: 0x4b8574325c5dc649a3deb230cad100beaa8889ff71947a3e3a35a7472e0a3942

DepositStETH 1.2 stETH
Revert: 0x2904232709baf654a2e2127a494d888de4ac31ae3ac5d643eed242a86f7c2b93

Drain: total balance of eth/stETH
Success: 0xcc0f4f6a52d617d2a7a3fb9a698afdcc8d21a8e1ebc35c5d0c8e576d79081315

Drain: 0 ETH 0 stETH
Success: 0x43a5efdfe34825c070ac29d09a2a62fe888d994e9f61b3e30d043aad707ae995

Deposit 11 stETH (when rETH balance low)
Revert: 0x43d2804433d2cac8c2faf4b8196dd99cd8e22c009b5e928ad8f85a7b3e4cb6a6

Deposit 10 ETH (when rETH balance low)
Revert: 0x3cc28b8525f28a7ebac988d26bd7cd1e3ad6e172e12ba0b7bae1df77dfea7fdb

Deposit 0.93 ETH (when reth balance low)
Revert: 0x7a4ee6263fbd77a32ffd6dcaf768280ea1ae1bf39e56c704065ae441dd1fd858

Deposit 0.93 stETH (when reth balance low)
revert 0x3f109f270b65ac07cfc9a34f7f5f20522ef92bd98ed5ef19a8018c546d6135d5

This is the first draft of the auditor anouncement, so it may change.

1 Like