Lido Oracle V8 security review
Composable Security reviewed Lido (Lido Oracle V8 security review) on 24 Jun 2026: 21 findings, 0 critical; 14 marked fixed, 7 acknowledged.
Findings21
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 1 |
| Medium | 0 | 1 | 8 |
| Low | 0 | 6 | 5 |
HighMissing pending top ups in CL pending balance calculationFixed
The report gives no description here.
MediumExternal operator data length mismatch between on-chain and off-chainFixed
The report gives no description here.
MediumIncorrect slashings ring buffer projection can under-estimate midterm slashing penaltyFixed
The report gives no description here.
MediumInfinite loop in get_node_operator_weight if dormant curated module weight branch is enabledFixed
The report gives no description here.
MediumIntra-frame CL rebase correction ignores pending top-ups on existing validatorsFixed
The report gives no description here.
MediumInvalid type of returned valueFixed
The report gives no description here.
MediumInvalid weights for CMv1 Node OperatorsFixed
The report gives no description here.
MediumOverstated buffered ether allocated for withdrawal finalizationFixed
The report gives no description here.
MediumPredictable target balance includes pending consolidations whose source can be slashedFixed
The report gives no description here.
LowDocument or enforce the consolidationsource invariant for predictable balance helpersFixed
The report gives no description here.
Show 4 more
LowEjector deposit lock uses current reserve instead of the per-frame reserve targetFixed
The report gives no description here.
LowFix comment in VEBO exit-order tableFixed
The report gives no description here.
LowRemove unused functions from production codeFixed
The report gives no description here.
LowStale find_frame cache is not cleared when staking module oracle state is resetFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 1 report · latest Sep 2026
See Composable Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us