Jun 25 2024
Liquid Collective has successfully completed a thorough security audit conducted by Quantstamp, a leading blockchain security firm. This 8th security review of Liquid Collective code reaffirms Liquid Collective’s commitment to meeting the highest standards of security and operational excellence.
The audit revealed that Liquid Collective's code is of high quality, with no high-severity vulnerabilities identified, and the report found “the project's code to be well-structured and easy to read, with robust metrics and log collection demonstrating operational maturity.” Recommendations to improve testing were included.
Overall, the audit included an architecture review, unit testing, functional testing, computer-aided verification, and manual review. 14 total issues were identified, including 0 high severity issues, 1 medium severity issue (1 fixed), 3 low severity issues (2 fixed, 1 acknowledged) , 4 undetermined severity findings (1 fixed, 3 acknowledged), and 6 informational issues (6 fixed).
Importance of auditing offchain components
Security audits are essential not only for smart contract code, but also for the offchain components that support the protocol. While it’s most common for protocols to undergo audits of their immutable smart contract code, offchain elements such as daemons and deployment configurations can pose significant security risks if not properly audited and secured. Ensuring these components adhere to stringent security standards is vital for ensuring the overall integrity and security of an enterprise-grade staking ecosystem.
The audit completed by Quantstamp critically covered Liquid Collective’s three daemons:
- Exit daemon: This daemon is responsible for notifying Liquid Collective’s Node Operators to process the exit of validators from the Liquid Collective protocol. It ensures that validators can exit the network securely and efficiently.
- Keeper daemon: The keeper daemon is responsible for listening to certain events - deposits and withdrawals - and call the relevant methods of the Liquid Collective protocol to actually deposit or exit validators.
- Oracle daemon: This daemon is crucial for providing external data from the consensus layer to the Liquid Collective protocol. It fetches, verifies, and feeds data from external sources into the system, ensuring that the protocol has accurate and up-to-date information to function correctly.
These daemons play essential roles in maintaining the security, stability, and functionality of the Liquid Collective protocol, making their security and operational integrity critical components of the overall system.
You can view all of Liquid Collective’s audits and security reviews here. For more information about Liquid Collective’s security practices, security reviews, and code audits, visit Liquid Collective’s Diligence hub here, and sign up for monthly Liquid Collective Updates here.
About Quantstamp
Quantstamp is a global leader in blockchain security, on a mission to secure the future of web3.
Founded in 2017, the team has honed its expertise through hundreds of audits and worked with some of the top projects in the industry including Ethereum 2.0, Solana, Binance Smart Chain, Visa, TON, Sandbox, Alchemy, Pendle, Stacks, and many more. To date, Quantstamp has performed 750+ audits and secured over $200 billion in digital asset risk from hackers. In addition to providing an array of security services, Quantstamp facilitates the growth and longevity of the web3 space through strategic investments and acting as a trusted advisor to help projects scale.
To learn more head to our website Quantstamp.com or follow us on Twitter/X @Quantstamp
About Liquid Collective
Liquid Collective is the trusted and secure staking standard: designed to meet the needs of enterprises, built and supported by a broad and dispersed collective of industry leaders. Learn more at liquidcollective.io.
