Napier Finance - LST/LRT Integrations — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Napier Finance - LST/LRT Integrations, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 2
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 2 closed, publicly disclosed Napier Finance - LST/LRT Integrations reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Logic error, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Logic error findings disclosed against Napier Finance - LST/LRT Integrations
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Napier Finance - LST/LRT Integrations: `currentStakeLimit` depletes faster in some adapters, due to actual amount spent less than the input `stakeAmount`
Napier Finance's LST/LRT adapter layer maintains a `currentStakeLimit` that mirrors the underlying staking pool's buffer cap to prevent draining it. In `BaseLSTAdapterUpgradeable.prefundedDeposit()`, the limit is decremented by the requested `stakeAmount` before staking actually occurs. However, `_stake()` may spend fewer ETH than requested — in the Kelp `RsETHAdapter`, the input is explicitly capped to `stakeLimit` of the RsETH deposit pool — so the ledgered stake limit is reduced more than the real spend, causing the cap to deplete prematurely over successive calls. This is a pure accounting-drift logic error with no direct fund loss, only a degraded/stuck staking buffer, which is why Sherlock accepted it as medium. The fix was to record the stake limit using the actual spent amount returned by `_stake()`, merged in napier-v1 PR #219 and napier-uups-adapters PR #9 with Lead Senior Watson sign-off.
Napier Finance - LST/LRT Integrations: Less rsETH minted than intended in volatile conditions. due to zero slippage when staking ETH to mint rsETH
Napier's RsETHAdapter stakes WETH into Kelp DAO's rsETH deposit pool while passing a zero minimum-slippage threshold (`minRSETHAmountExpected = 0`). Because rsETH's price is set by an oracle that tracks live DEX markets that can spike during volatility or LRT depegs, the mint can land at a temporarily inflated rsETH price and return fewer rsETH tokens than the intended economic value. Since the adapter level has no out-of-bound slippage protection, these batches mint at an adverse price and the vault loses value relative to what it would have received under normal pricing.