LSD Token Integration Patterns

Detects vulnerabilities in Liquid Staking Derivative token integrations during Solidity smart contract audits.

66|17|Updated Jan 21, 2026
One-click install
npx skills add https://github.com/BitterSecurity/Vigilo --skill lsd-token-integration-patterns-bittersecurity
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: LSD Token Integration Patterns
Source: https://github.com/BitterSecurity/Vigilo/tree/main/packages/claude/skills/integration-patterns/lsd-tokens
Command: npx skills add https://github.com/BitterSecurity/Vigilo --skill lsd-token-integration-patterns-bittersecurity

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Auditing smart contracts that integrate Liquid Staking Derivative tokens like stETH, wstETH, rETH, cbETH, and sfrxETH is error-prone because each token behaves differently—rebasing balances, varying exchange rates, and transfer rounding can silently introduce critical vulnerabilities that standard ERC20 assumptions miss. ## Core Features & Use Cases - Token-Specific Patterns: Covers stETH rebasing (use shares, not balances), wstETH wrapping, rETH/cbETH exchange rates, and sfrxETH ERC4626 conversions with interface definitions and code examples. - Vulnerability Detection: Identifies critical issues like caching rebasing balances, hardcoded 1:1 ETH ratio assumptions, and 1-2 wei transfer rounding errors, with vulnerable vs. secure Solidity code comparisons. - Audit Checklist & Severity Classification: Provides a structured checklist per token type and classifies findings as Critical, High, or Medium for consistent reporting. - Use Case: During a DeFi vault audit, the token-auditor agent detects stETH deposits and applies this skill to flag that the contract caches raw balances instead of using getSharesByPooledEth, causing users to lose rebase rewards. ## Quick Start Audit this Solidity vault contract that accepts stETH and rETH deposits and report any liquid staking derivative integration vulnerabilities with severity ratings.

Frequently Asked Questions about LSD Token Integration Patterns

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit a smart contract that integrates stETH?▼

Check that the contract tracks shares via getSharesByPooledEth instead of caching raw balances, since stETH rebases daily. Also verify it handles 1-2 wei transfer rounding and uses transferShares for exact amounts.

What are common vulnerabilities with liquid staking tokens in DeFi?▼

The most critical issues are assuming a 1:1 ratio with ETH instead of using the exchange rate, caching rebasing token balances, and accumulating transfer rounding errors. Missing withdrawal queue handling and stale exchange rates are also frequent findings.

What is the difference between stETH and wstETH for smart contract integration?▼

stETH is a rebasing token whose balance increases daily, making it incompatible with standard DeFi accounting. wstETH is a non-rebasing wrapper whose value appreciates via the stEthPerToken exchange rate, so simple balance tracking works.

How do I get the ETH value of rETH or cbETH in Solidity?▼

For rETH, call getEthValue(rethAmount) on the Rocket Pool token contract. For cbETH, multiply the balance by exchangeRate() divided by 1e18, though an oracle is recommended for security-critical valuations.

Why does stETH transferFrom receive less than the requested amount?▼

stETH transfers have a 1-2 wei rounding error due to internal share-based accounting, so the received amount can be slightly less than requested. Use transferShares with share amounts to get exact transfers.