Skip to content

Repository files navigation

Tests for Lido NEST (automated buybacks)

This repository contains a test suite for the Lido NEST automated-buyback system (the Stonks-based BuybackAllocator / BuybackExecutor stack plus the TokenRateNotifier wiring): a mainnet deployment verification and two property-based manually-guided fuzz suites. Tests are written in the Wake development and testing framework.

Tested with wake version 5.0.0rc2.

Fuzzing

Both suites fuzz BuybackAllocator + BuybackExecutor end to end (real Curve pool, in-repo Stonks/Order + CoW stubs, OracleRouter with mock Chainlink feeds, and StakingRevenueSource revenue).

  1. Clone this repository
  2. git submodule update --init --recursive if not cloned with --recursive
  3. Install submodule dependencies so the wake.toml remappings resolve (stonks/: npm install; core/: yarn + Foundry libraries)
  4. wake up pytypes to generate pytypes
  5. Run a suite:
    • wake test tests/test_fuzz1.py — runs on a local chain (no fork). The Curve Twocrypto-NG pool is deployed in-process from the committed bytecode and stETH is the migrated real Lido share-math contract, so no RPC is required.
    • RPC_URL=<mainnet-rpc> wake test tests/test_fuzz2.py — runs against an Ethereum mainnet fork at block 25387530 (real Curve factory + live wiring). Requires RPC_URL.

Deployment verification

tests/test_nest_deployment.py forks mainnet just before the NEST deploy (block 25544881), replays the 8-transaction deployment, and checks each of the 9 live contracts — StonksFactory, Order (sample), StakingRevenueSource, BuybackExecutor, BuybackAllocator, Stonks (LP and Treasury), TokenRateNotifier, and the new LidoLocator implementation — for a matching address, executable bytecode (metadata stripped), and configuration. The verified addresses are listed in scope.md.

It uses a dedicated config so pytypes are compiled to match the deployed bytecode:

  1. Clone this repository
  2. git submodule update --init --recursive if not cloned with --recursive
  3. Install submodule dependencies (see Fuzzing, step 3)
  4. wake --config wake-deployment-verification.toml up pytypes to generate pytypes
  5. RPC_URL=<mainnet-rpc> wake --config wake-deployment-verification.toml test tests/test_nest_deployment.py

Requires RPC_URL pointing at an archive-capable mainnet endpoint (it forks at the block above and also reads the live chain for comparison).

About

Manually guided differential fuzz tests from the ack3 security review of Lido NEST

Topics

Resources

Contributing

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages