Security Audits
The Pashov Audit Group review covers Olla's reviewed source and fixes at commit
5be8601.
The v1.1 mainnet launch source under contracts/src matches that fixes-reviewed source.
The currently active StakingManager implementation contains a subsequent Aztec v5
reward-accounting change that is not covered by this audit. The update was introduced
in PR #482, at commit
3607f5a.
The published report should not be taken as an audit of this updated implementation.
StakingManager.getClaimableRewards() now includes reported sequencer rewards without
consulting the legacy isRewardsClaimable() gate. This supports Aztec v5 reward views.
On tracked legacy rollups that still time-lock reward claims, reported rewards may
affect totalAssets() and the stAztec exchange rate before they can be harvested.
The active mainnet implementation is listed below. This disclosure concerns the StakingManager update; it does not mean all Olla contracts have changed since the review.
| Network | Active StakingManager implementation | Audit status |
|---|---|---|
| Ethereum mainnet | 0xe988ffa40382df506d04dc1d0fbda13e17316555 | Unaudited post-review change; not covered by the published Pashov report |
See the mainnet deployment page for the proxy addresses and on-chain verification details.
Olla's reviewed core contracts and fixes have been independently audited by Pashov Audit Group. The full report is available as a PDF:
About Pashov Audit Group
Pashov Audit Group consists of 40+ freelance security researchers, who are well proven in the space -- most have earned over $100k in public contest rewards, are multi-time champions or have truly excelled in audits with us. We only work with proven and motivated talent.
With over 300 security audits completed -- uncovering and helping patch thousands of vulnerabilities -- the group strives to create the absolute very best audit journey possible.
While 100% security is never possible to guarantee, we do guarantee you our team's best efforts for your project.
Check out their previous work here or reach out on Twitter @pashovkrum.
Disclaimer
A smart contract security review can never verify the complete absence of vulnerabilities. This is a time, resource and expertise bound effort where we try to find as many vulnerabilities as possible. We can not guarantee 100% security after the review or even if the review will find any problems with your smart contracts. Subsequent security reviews, bug bounty programs and on-chain monitoring are strongly recommended.
Executive Summary
A time-boxed security review of the ollafinance/core repository was done by Pashov Audit
Group, during which ast3ros, DemoreXTess, TejasWarambhe, trtrth, ValvesSecurity engaged to
review Olla. A total of 58 issues were uncovered.
| Project Name | Olla |
| Protocol Type | ERC7540 liquid staking protocol |
| Timeline | April 8th 2026 - April 21st 2026 |
| Review commit | f9c8502 |
| Fixes review commit | 5be8601 |
Scope
| Contract | Contract |
|---|---|
OllaCore.sol | RewardsAccumulator.sol |
IOllaCore.sol | IRewardsAccumulator.sol |
GovernanceLib.sol | IOllaGovernance.sol |
OllaGovernance.sol | ISafetyModule.sol |
SafetyModule.sol | RolesLib.sol |
StakingManager.sol | StakingProviderRegistry.sol |
IAztecRollup.sol | IAztecRollupRegistry.sol |
IStakingManager.sol | IStakingProviderRegistry.sol |
AztecTypes.sol | BN254Lib.sol |
QueueLib.sol | OllaVault.sol |
StAztec.sol | WithdrawalQueue.sol |
IOllaVault.sol | IStAztec.sol |
IWithdrawalQueue.sol |
Reporting a Vulnerability
Please follow the Security Policy for responsible disclosure.
Do not open a public GitHub issue or pull request for security vulnerabilities.