Helion Protocol

Each report is finalised when quorum members have submitted the same report hash for a frame. setQuorum(q) only requires q > 0, and removeMember() decrements the member count without re-checking the quorum. With seven members and a quorum of four, removing three members leaves four members and a quorum of four, which is fine; but a later setQuorum(2) or an initial misconfiguration lets two members finalise reports alone.

Reports drive totalPooledEther, so a finalised false report changes every hETH balance. The pool applies sanity bounds to the implied annual rate, but the bounds were generous (an annualised 27% positive rebase) and a negative report is bounded only by the slashing limit.

The defect is that the safety of the oracle depends on an invariant (quorum is a strict majority) that the contract does not enforce.

Value transferred from stakers to the colluding members, bounded by the rebase limit per report; repeated reports compound the loss.

Enforce quorum ≥ members / 2 + 1 in setQuorum, addMember and removeMember, and tighten the positive rebase bound to a realistic annualised rate.

Fixed. The quorum is validated on every membership change, and the positive rebase bound was lowered to an annualised 10%.

When a batch of withdrawal requests is finalised, the pool reserves floor(sumShares × rate / PRECISION) ETH for the whole batch, where rate is the share rate applied to the batch. Each claim later computes its own amount with Math.mulDiv(requestShares, rate, PRECISION, Math.Rounding.Ceil); the developers rounded claims up so that no user would receive less than their shares are worth.

The two calculations round in opposite directions. Each claim can exceed its exact share of the reservation by up to one wei, while the reservation itself is rounded down, so the sum of claims in a batch can exceed the reserved ETH by up to the number of requests in the batch. Claims are paid first come, first served out of lockedEther.

The shortfall is tiny, but its effect is binary: the last claimant in the batch finds the reservation exhausted and the transaction reverts. The user is blocked until someone donates the missing wei or a later batch happens to over-reserve.

Denial of withdrawal for affected users until manual intervention. Invariant P4 (queue solvency) is violated.

Compute each request's claimable ETH once at finalisation with a single rounding direction (down), reserve exactly the sum of those stored amounts, and pay claims from the stored value.

Fixed. Claims are paid from stored per-request amounts and invariant P4 holds on the remediation commit.

hETH balances are derived from shares. A transfer of amount converts to shares with amount × totalShares / totalPooledEther, rounding down, so the recipient's balance increases by slightly less than amount and the sender may retain one or two wei after "transferring everything".

This is inherent to rebasing tokens built over shares. It does not lose value for the protocol, but integrations that assume balanceOf(recipient) increases by exactly amount (vaults, bridges, accounting that compares balances) can fail or record dust mismatches.

Integration failures and dust balances; no loss to stakers.

Document the behaviour prominently, provide transferShares() for integrators, and recommend a non-rebasing wrapper for DeFi use.

Acknowledged. Documented in the integration guide; transferShares() and a wrapped non-rebasing token are available.

The deposit contract keys validators by public key. If a deposit for a given public key already exists, subsequent deposits for the same key top up that validator and keep the withdrawal credentials of the first deposit.

An operator registers a signing key with Helion, observes the pool's 32 ETH deposit for that key in the mempool, and front-runs it with a 1 ETH deposit for the same key using withdrawal credentials it controls. The pool's deposit then tops up a validator whose withdrawals go to the operator.

Operators are permissioned, which lowers likelihood, but each successful front-run diverts a full 32 ETH deposit.

Loss of 32 ETH per front-run deposit.

Before each deposit, check the deposit contract's get_deposit_root() against a root signed by a quorum of independent guardians, so that any deposit in between invalidates the batch.

Fixed with a new DepositGuard contract requiring signatures from four of six guardians over the current deposit root.

Reports describe the validator balance at a reference slot. When applying a report, the pool pulls the entire current balance of the WithdrawalVault, which also includes ETH from withdrawals processed between the reference slot and the moment the report lands on-chain (often several hours).

The validator balance in the report already excludes those withdrawals only if they happened before the reference slot. ETH that arrived later is therefore counted twice in the next report cycle and once as an unexplained reward now, producing an inflated rebase followed by a smaller one. Arbitrageurs who track withdrawals can deposit before an inflated report and request withdrawal after it.

Small, repeated transfers of value from long-term stakers to rebase arbitrageurs.

Include the vault balance at the reference slot in the report and transfer only that amount when applying it.

Fixed. Reports now carry the vault balance at the reference slot.

Pausing stops deposits, transfers and withdrawals. The role is held by one EOA used by the on-call engineer. Fast pausing is valuable in an incident, but a single key can also freeze user funds indefinitely if compromised, and unpausing requires the same key.

Temporary freezing of user funds; no direct theft.

Move pausing to a guardian multisig with a low threshold and limit pause duration, with unpausing through governance.

Fixed. Pausing moved to a 2-of-5 guardian multisig; pauses expire after 14 days unless renewed by governance.

Membership and quorum changes update storage without events, so monitoring cannot detect the configuration change behind HP-01 without polling storage.

Reduced ability to detect governance changes to the oracle.

Emit MemberAdded, MemberRemoved and QuorumChanged.

Fixed.