Lido Oracle V8 security review
Composable Security reviewed Lido (Lido Oracle V8 security review) on 24 Jun 2026: 21 findings, 0 critical; 14 marked fixed, 7 acknowledged.
No open critical findings
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 8 |
| Low | 0 | 6 | 5 |
MediumPerformance Web Server publicly bound by default with no authentication, authorization or rate limitingAcknowledged
The report gives no description here.
LowEnd-of-period validator balances attributed across earlier frames for fee distributionAcknowledged
The report gives no description here.
LowExit order share-rate predicate uses absolute excess instead of relative deviationAcknowledged
The report gives no description here.
LowPer-report exit limit overcounts compounding validators that have not been topped upAcknowledged
The report gives no description here.
LowRemove redundant consolidating as source guard in exit predicatesAcknowledged
The report gives no description here.
LowRemove slashed validators from network performance aggregateAcknowledged
The report gives no description here.
LowStaking module performance state initialization crashes when epochs_per_frame is reconfiguredAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoAudits39 audits by 12 firmsLast audit Sep 2026, by Composable Security.
Critical findings2 criticals acknowledged, not fixedReported in 2 reports, the latest by Statemind, Apr 2023. The team acknowledged both.
Open Lido’s security recordSecurity firm
Composable Security
1 project reviewed · 1 report · latest Sep 2026
See Composable Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us