SymbioticVerifier

Overview

SymbioticVerifier is a custom ICustomVerifier implementation used to authorize interactions with the Symbiotic protocol. It restricts access to deposit, withdraw, claim, and claimRewards calls across Symbiotic vaults and farm contracts. All permissions are tightly scoped using role-based access control via MellowACL. This verifier ensures that only allowed addresses (typically curators) can perform specific actions within the Symbiotic ecosystem.

Purpose

The verifier ensures that:

Only whitelisted vaults can act on behalf of themselves in Symbiotic vaults and farms
All interactions are strictly validated against exact calldata to prevent misuse or encoding variation
Only allowed selectors and targets can be used

Role Definitions

Role Constant	Description
`CALLER_ROLE`	Who is allowed to initiate Symbiotic operations (typically curators)
`MELLOW_VAULT_ROLE`	Addresses that are allowed to be the recipient of deposits, withdrawals, or claims (usually Subvaults)
`SYMBIOTIC_VAULT_ROLE`	Contracts that are approved as Symbiotic vault
`SYMBIOTIC_FARM_ROLE`	Contracts that are approved as Symbiotic farm

Constructor

constructor(address vaultFactory_, address farmFactory_, string memory name_, uint256 version_)

`verifyCall`

function verifyCall(
    address who,
    address where,
    uint256 value,
    bytes calldata callData,
    bytes calldata /* verificationData */
) public view returns (bool)

High-Level Behavior

Verifies caller (who) has CALLER_ROLE
Matches target contract (where) with either a Symbiotic vault or farm
Validates exact function selector and arguments using full keccak256(callData) hash
Rejects any calls with non-zero ETH value

Supported Calls

Target Type	Function	Signature	Additional Checks
Symbiotic Vault	`deposit(onBehalfOf, amount)`	`ISymbioticVault.deposit.selector`	`onBehalfOf` must have `MELLOW_VAULT_ROLE`, `amount > 0`
Symbiotic Vault	`withdraw(claimer, amount)`	`ISymbioticVault.withdraw.selector`	`claimer` must have `MELLOW_VAULT_ROLE`, `amount > 0`
Symbiotic Vault	`claim(recipient, epoch)`	`ISymbioticVault.claim.selector`	`recipient` must have `MELLOW_VAULT_ROLE`
Symbiotic Farm	`claimRewards(recipient, token, data)`	`ISymbioticStakerRewards.claimRewards.selector`	`recipient` must have `MELLOW_VAULT_ROLE`, `token != 0x0`

For all calls, the calldata must exactly match the selector and parameters
All other selectors or targets are denied

Security Properties

Strict call gating: Only explicitly allowed selectors, targets, and roles pass
Calldata hash check: Enforces strict encoding to avoid alternate ABI variants or garbage data
Zero-value enforcement: Prevents accidental ETH transfers
Factory pattern compatibility: Target contracts can be validated indirectly via registries

​Overview

​Purpose

​Role Definitions

​Constructor

​verifyCall

​High-Level Behavior

​Supported Calls

​Security Properties