Lido CSM v3 and CM v2 security review
Statemind reviewed Lido (Lido CSM v3 and CM v2 security review) on 30 Jun 2026: 20 findings, 0 critical; 14 marked fixed, 6 acknowledged.
Findings20
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 0 |
| Low | 0 | 6 | 14 |
Low.length is re-evaluated on every iteration in for-loopsFixed
The report gives no description here.
LowBondCurve.getBondAmountByKeysCount() and BondCurve.getKeysCountByBondAmount() revert with a generic panic for invalid curveIdFixed
The report gives no description here.
LowCharge penalty recipient setter does not reject stETH addressFixed
The report gives no description here.
LowCuratedDepositAllocator._computeAllocations() precondition n > 0 is not enforced by CuratedDepositAllocator.allocateInitialDeposits()Fixed
The report gives no description here.
LowCuratedModule._updateDepositInfo() duplicates the BaseModule implementation instead of calling superFixed
The report gives no description here.
LowDuplicate key pointer encoding logic in WithdrawnValidatorLibFixed
The report gives no description here.
LowGas OptimizationsFixed
The report gives no description here.
LowInconsistent top-up eligibility and quantization can reduce effective distributionFixed
The report gives no description here.
LowMinor gas optimizationsFixed
The report gives no description here.
LowMinor gas optimizationsFixed
The report gives no description here.
Show 4 more
LowMissing bond curve existence validation causes unnecessary global refreshesFixed
The report gives no description here.
LowMissing input validation enables key-pointer collision in view return valuesFixed
The report gives no description here.
LowMultiple interface errors are not usedFixed
The report gives no description here.
LowUnused custom errors and a redundant inline interfaceFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 11 reports · latest Jun 2026
See Statemind’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us