Lido CSM v3 and CM v2 audit
Certora reviewed Lido (Lido CSM v3 and CM v2 audit) on 17 Mar 2026: 5 findings, 0 critical; 1 marked fixed, 4 acknowledged.
Findings5
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 4 | 1 |
Marked Informational by the firm. Not counted as findings.
InformationalExtended-mode changeNodeOperatorRewardAddress() lacks ownership confirmationAcknowledged
The report gives no description here.
InformationalunstETH claim requires undocumented manual redemption step when rewardAddress is a passive contractAcknowledged
The report gives no description here.
InformationalBond lockPeriod documentation overpromises auto-unlockFixed
The report gives no description here.
InformationalETH bond path silently absorbs msg.value overpayment as additional bondFixed
The report gives no description here.
InformationalExpiredBondLockRemoved event not emitted when an expired bond lock gets overwritten by a new lockFixed
The report gives no description here.
InformationalgetNodeOperatorsCount, getActiveNodeOperatorsCount and getNodeOperatorIsActive have misleading names and functionalityFixed
The report gives no description here.
InformationalRetroactive bond curve updates can silently unbond existing Node OperatorsFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
Certora9 projects reviewed · 17 reports · latest Jun 2026
See Certora’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us