SymbioticVerifier

Overview

SymbioticVerifier is a custom ICustomVerifier implementation used to authorize interactions with the Symbiotic protocol. It restricts access to deposit, withdraw, claim, and claimRewards calls across Symbiotic vaults and farm contracts. All permissions are tightly scoped using role-based access control via MellowACL.

This verifier ensures that only allowed addresses (typically curators) can perform specific actions within the Symbiotic ecosystem.

Purpose

The verifier ensures that:

  • Only whitelisted vaults can act on behalf of themselves in Symbiotic vaults and farms

  • All interactions are strictly validated against exact calldata to prevent misuse or encoding variation

  • Only allowed selectors and targets can be used

Role Definitions

Role Constant
Description

CALLER_ROLE

Who is allowed to initiate Symbiotic operations (typically curators)

MELLOW_VAULT_ROLE

Addresses that are allowed to be the recipient of deposits, withdrawals, or claims (usually Subvaults)

SYMBIOTIC_VAULT_ROLE

Contracts that are approved as Symbiotic vault

SYMBIOTIC_FARM_ROLE

Contracts that are approved as Symbiotic farm

Constructor

constructor(address vaultFactory_, address farmFactory_, string memory name_, uint256 version_)

verifyCall

function verifyCall(
    address who,
    address where,
    uint256 value,
    bytes calldata callData,
    bytes calldata /* verificationData */
) public view returns (bool)

High-Level Behavior

  • Verifies caller (who) has CALLER_ROLE

  • Matches target contract (where) with either a Symbiotic vault or farm

  • Validates exact function selector and arguments using full keccak256(callData) hash

  • Rejects any calls with non-zero ETH value

Supported Calls

Target Type
Function
Signature
Additional Checks

Symbiotic Vault

deposit(onBehalfOf, amount)

ISymbioticVault.deposit.selector

onBehalfOf must have MELLOW_VAULT_ROLE, amount > 0

Symbiotic Vault

withdraw(claimer, amount)

ISymbioticVault.withdraw.selector

claimer must have MELLOW_VAULT_ROLE, amount > 0

Symbiotic Vault

claim(recipient, epoch)

ISymbioticVault.claim.selector

recipient must have MELLOW_VAULT_ROLE

Symbiotic Farm

claimRewards(recipient, token, data)

ISymbioticStakerRewards.claimRewards.selector

recipient must have MELLOW_VAULT_ROLE, token != 0x0

  • For all calls, the calldata must exactly match the selector and parameters

  • All other selectors or targets are denied

Security Properties

  • Strict call gating: Only explicitly allowed selectors, targets, and roles pass

  • Calldata hash check: Enforces strict encoding to avoid alternate ABI variants or garbage data

  • Zero-value enforcement: Prevents accidental ETH transfers

  • Factory pattern compatibility: Target contracts can be validated indirectly via registries

PreviousERC20VerifierNextEigenLayerVerifier