Stakingverse Lukso

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

This appears to be a real LUKSO staking helper, but it asks for a wallet/controller private key and can send mainnet transactions without enough guardrails or secret-handling warnings.

Review this skill before installing or running it with real funds. Use a dedicated low-value, least-privileged controller key if possible; do not paste private keys into scripts, repositories, shell history, logs, or shared automation. Verify the LUKSO mainnet, Universal Profile, Key Manager, vault address, and amount before every run, and expect gas costs and irreversible on-chain effects. Be aware that the unstake and claim scripts appear to have ABI defects, and SKILL.md references a check-claim.js file that is not present.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28

Finding

Unsafe Private-Key Configuration Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:28-35
Vulnerability Type: Plaintext secret exposure through insecure configuration guidance
Risk Level: Medium

Vulnerable Code

bash

Set these environment variables or edit the scripts:

export STAKINGVERSE_VAULT="0x9F49a95b0c3c9e2A6c77a16C177928294c0F6F04"
export MY_UP="your_universal_profile_address"
export CONTROLLER="your_controller_address"
export PRIVATE_KEY="your_controller_private_key"
export RPC_URL="https://rpc.mainnet.lukso.network"

Technical Analysis

The documentation explicitly permits users to edit the scripts to provide configuration values, including the controller's private key. Embedding a private key in source code places a high-value credential in a file that may subsequently be committed to version control, copied into archives, uploaded for support, cached by development tools, or distributed with the skill.

The scripts use this credential to instantiate an ethers.Wallet capable of signing blockchain transactions. Consequently, disclosure is not limited to account identification: it exposes all transaction authority granted to that controller.

The environment-variable alternative is safer than source embedding but still leaves the key accessible to the process and potentially to process inspection, crash diagnostics, or insecure shell history. The documentation does not recommend a secret manager, hardware-backed signer, or restricted credential lifecycle.

Attack Path

1. A user follows the instruction allowing configuration values to be inserted directly into the scripts.
2. The user places the controller private key in a project file.
3. The modified project is committed, archived, uploaded, shared, or otherwise exposed.
4. An attacker retrieves the plaintext private key.
5. The attacker imports the key into a wallet or signing program.
6. The attacker submits any transaction permitted by that controller, ...[truncated 483 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the phrase permitting users to edit scripts with configuration values.
• Explicitly prohibit storing private keys in source files, repositories, shell history, logs, or project archives.
• Use a dedicated secret manager, encrypted keystore, hardware wallet, or external signing service.
• If environment variables must be supported, document their residual exposure risks and recommend short-lived, least-privileged controller keys.
• Validate that the controller has only the minimum permissions required for staking, withdrawal, and claim operations.
• Add secret-scanning controls such as pre-commit hooks and CI checks.
• Document an immediate key-revocation and rotation procedure for accidental exposure.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/stake.js:35

Finding

Unvalidated Transaction Destination Derived from Profile Storage

Content

View full analysis

Vulnerability Details

File Location: scripts/stake.js:35-58
Vulnerability Type: Untrusted address resolution for a value-bearing blockchain transaction
Risk Level: Medium

Vulnerable Code

javascript

const provider = new ethers.JsonRpcProvider(RPC_URL);
const wallet = new ethers.Wallet(PRIVATE_KEY, provider);

// Get Key Manager address
const up = new ethers.Contract(MY_UP, UP_ABI, provider);
const keyManagerBytes = await up.getData('0xdf30dba06db6ede4cd4a817e2b67b0eb0e9e6e8c2e5a5b6e5d6c7e8f9a0b1c2d'); // LSP6KEY_KEYMANAGER_INTERNAL
const keyManager = '0x' + keyManagerBytes.slice(26, 66);

console.log('Key Manager:', keyManager);

// Encode deposit call
const vaultInterface = new ethers.Interface(VAULT_ABI);
const depositData = vaultInterface.encodeFunctionData('deposit', [MY_UP]);

// Encode UP.execute
const amountWei = ethers.parseEther(amountLYX.toString());
const upInterface = new ethers.Interface(UP_ABI);
const upExecuteData = upInterface.encodeFunctionData('execute', [
  0, // CALL
  STAKINGVERSE_VAULT,
  amountWei,
  depositData
]);

console.log('Sending transaction...');

const keyManagerContract = new ethers.Contract(keyManager, KEY_MANAGER_ABI, wallet);
const tx = await keyManagerContract.execute(upExecuteData, { value: amountWei });

The same unchecked extraction pattern also appears in:

• scripts/unstake-request.js:29-31,52-53
• scripts/claim.js:43-45,66-67

Those two scripts currently contain a separate reliability defect because their UP_ABI declarations omit getData, so they are expected to fail before reaching the transaction. The immediately exploitable value-bearing path is in scripts/stake.js.

Technical Analysis

The script accepts MY_UP from the environment and queries that address for an alleged Key Manager storage value. It then slices bytes at fixed offsets and treats the result as the destination of a signed transa ...[truncated 1935 chars]

Remediation

View remediation

Remediation Suggestions

• Validate MY_UP with ethers.isAddress and reject the zero address.
• Query and enforce the expected LUKSO Mainnet chain ID before resolving addresses or signing transactions.
• Use the canonical LSP6 storage key and decoding procedure from a reviewed library rather than manually slicing unvalidated bytes.
• Require the returned value to have the exact expected length and encoding.
• Verify that bytecode exists at both the profile and resolved Key Manager addresses.
• Verify the relationship between the Universal Profile, Key Manager, and configured controller using canonical interface and ownership checks.
• Display the network, profile, Key Manager, vault, method, and value before signing.
• Require explicit user confirmation for every value-bearing transaction.
• Consider allowing users to configure an independently verified Key Manager address and compare it against the on-chain result.
• Add balance and amount validation, including rejection of zero, negative, non-finite, malformed, or unexpectedly large values.
• Add getData(bytes32) to the UP_ABI declarations in the withdrawal and claim scripts, then apply the same validation controls there before making those paths operational.

T08 · Insecure Dependencies

Note

• Location: README.md:8

Finding

Unpinned Wallet Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: README.md:8-12
Vulnerability Type: Unpinned third-party dependency in a private-key signing workflow
Risk Level: Low

Vulnerable Code

bash

git clone https://github.com/LUKSOAgent/stakingverse-lukso-skill.git
cd stakingverse-lukso-skill
npm install ethers

Technical Analysis

The installation instructions install ethers without a version constraint. The audited project structure also contains no package.json or lockfile that records an exact dependency version and integrity metadata.

As a result, the package code installed and executed by a future user is not uniquely determined by the audited repository. A later release may introduce incompatible behavior, a compromised registry account could publish malicious code, or dependency resolution could otherwise produce code that was never reviewed.

This is particularly sensitive because ethers runs in the same Node.js process as the scripts and therefore has access to the environment, including STAKING_PRIVATE_KEY. It also participates directly in wallet construction, RPC communication, transaction encoding, and signing.

Attack Path

1. A user follows the documented installation command at a later date.
2. npm resolves the then-current ethers release and its transitive dependency graph.
3. The resolved package differs from the version assumed during the audit or has been compromised.
4. The user runs a staking, withdrawal, claim, or balance script.
5. The dependency executes in the same process and can access environment variables and transaction data.
6. Malicious package code could exfiltrate the private key, alter transaction destinations or amounts, or sign unintended transactions.

No malicious dependency is present in the supplied project evidence; this finding concerns the absence of reproducible and integrity-controlled dependency resolution.

Impact Assessment

If dependenc ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Add and commit a package.json containing an exact reviewed ethers version.
• Generate and commit a package lockfile with integrity hashes.
• Replace npm install ethers with npm ci in the documented installation process.
• Review dependency changes before updating the lockfile.
• Run dependency vulnerability and provenance checks in CI.
• Use trusted registries and enforce lockfile integrity.
• Avoid broad npm lifecycle-script execution where it is not required.
• Prefer hardware-backed or external signing so third-party JavaScript dependencies do not receive raw private-key material.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broader staking skill covering stake, unstake, claiming rewards, and balance checks on Stakingverse. The supplied code chunk implements only one operational path: deposit/stake LYX into the Stakingverse vault using UP.execute through a Key Manager, then query balanceOf for the configured UP. There is no callable function or CLI path for withdraw, claim, claimable checking, withdrawal requests, or any oracle-based claim flow. The accessed resource (Stakingverse vault on Lukso mainnet) is consistent with the description, so the mismatch is not about destination or permissions, but about overstating supported capabilities relative to the actual code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to export a controller private key directly into an environment variable but provides no warning about secret handling, shell history exposure, process inspection, or safer alternatives. Because this skill is specifically used to control a LUKSO Universal Profile and sign staking transactions, compromise of that key could enable unauthorized on-chain actions and loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README tells users how to stake, request unstake, and claim assets, but does not clearly warn that these are real on-chain transactions involving wallet authority, gas costs, timing delays, token burns during withdrawal requests, and possible irreversible mistakes from wrong amounts or wrong network use. In a staking skill, omission of transaction-risk warnings is more dangerous because the documented commands directly affect user funds and operational custody.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill contains code and instructions that rely on sensitive environment variables, including a private key and on-chain target addresses, but it declares no explicit tool scope or permissions boundary. In an agent setting, missing scope metadata can cause the runtime or reviewer to underestimate that the skill can access secrets and initiate blockchain transactions, increasing the chance of unsafe invocation or overbroad execution context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to place a controller private key in an environment variable without any warning about secret handling, storage, shell history, process inspection, CI logs, or using safer signing methods. Because this key can authorize KeyManager calls and move staking-related assets, accidental exposure could let an attacker stake, unstake, redirect claims, or otherwise control the user's Universal Profile actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The script directly consumes a raw private key from an environment variable and then uses it to submit on-chain transactions, but provides no guardrails, warnings, or safer credential-handling pattern. In an agent skill context, this is more dangerous because users may run the skill in automated environments where secrets are broadly exposed to logs, subprocesses, or misconfiguration, increasing the risk of wallet compromise and unauthorized staking-related transactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At L41 the comment says 'Get Key Manager', and L42 instantiates the contract with an ABI containing only execute(). However, L43 calls up.getData(...), which is not present in the declared ABI. This is an intent-code contradiction in the inline documentation/context because the code as written does not actually match the documented retrieval approach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script directly loads a signing key from STAKING_PRIVATE_KEY and uses it to submit an on-chain transaction, but provides no explicit safeguard, confirmation step, or warning that the operator is exposing a high-value key to an automation script. In a staking skill that interacts with a Universal Profile/Key Manager flow, misuse of the configured key or running the script in an unsafe environment could lead to unauthorized unstake requests or broader account compromise if the key has elevated permissions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script describes and implements an unstake request on Stakingverse, but its declared UP_ABI only includes execute(...) while the code later invokes up.getData(...) at L30. This is a direct mismatch between the code's stated contract interface/documented behavior and the operations it actually performs, indicating the file does not accurately represent what is needed for its advertised flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.