Reentrancy guard on external-calling functions
Rocket Pool's assessment for RD-F-014 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
Rocket Pool uses CEI (checks-effects-interactions) pattern rather than explicit OZ nonReentrant modifiers in core contracts. Consensys Diligence 2021 audit found a reentrancy issue that was addressed by implementing a custom reentrancy guard via state variable. No explicit nonReentrant import found in RocketTokenRETH.sol or megapool contracts via source inspection. Cannot confirm full reentrancy guard coverage across all 20+ contracts without tool run.
Sources #
- GitHub
- Consensys Diligence 2021 Rocketpool AuditConsensys Diligence 2021 audit — reentrancy issue found and addressedretrieved 2026-05-04
Methodology #
Determine whether all state-mutating functions that perform external calls carry `nonReentrant` or an equivalent reentrancy guard.
See the full factor methodology and distribution across all protocols →