Lido V2 security review
Statemind reviewed Lido (Lido V2 security review) on 28 Apr 2023: 120 findings, 2 critical; 75 marked fixed, 45 acknowledged.
Findings120
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 0 | 2 | 6 |
| Medium | 0 | 8 | 9 |
| Low | 0 | 34 | 59 |
CriticalFunds stealing by malicious staking moduleAcknowledged
The report gives no description here.
HighA Node Operator can circumvent DAO validator key approvalAcknowledged
The report gives no description here.
HighThe parameter depositCalldata can be hijacked by a front-runAcknowledged
The report gives no description here.
MediumA single staking module can block whole depositsAcknowledged
The report gives no description here.
MediumDeposits through DepositSecurityModule can be blocked by front-runAcknowledged
The report gives no description here.
MediumExcessive penaltyAcknowledged
The report gives no description here.
MediumFastLane length change leads to the disruption of the voting logicAcknowledged
The report gives no description here.
MediumManipulating active validators countAcknowledged
The report gives no description here.
MediumQuorum change leads to the disruption of the voting logicAcknowledged
The report gives no description here.
MediumRestriction of total feeAcknowledged
The report gives no description here.
Show 10 more
MediumWithdrawn stETH is not fully burntAcknowledged
The report gives no description here.
Low_checkAnnualBalancesIncrease() doesn't include withdrawn etherAcknowledged
The report gives no description here.
Low"Bunker mode" withdrawal implementationAcknowledged
The report gives no description here.
LowActive node operator checkAcknowledged
The report gives no description here.
LowAffecting on burn requestAcknowledged
The report gives no description here.
LowAvoiding heavy computationsAcknowledged
The report gives no description here.
LowClaim SLOAD reductionAcknowledged
The report gives no description here.
LowConsecutively emitting identical eventsAcknowledged
The report gives no description here.
LowDEADLINE_SLOT_OFFSETAcknowledged
The report gives no description here.
LowDepositable ether zero checkAcknowledged
The report gives no description here.
Show 10 more
LowExtra if statement in _checkConsensus methodAcknowledged
The report gives no description here.
LowGas optimizationAcknowledged
The report gives no description here.
LowGas optimization: MinAllocationAcknowledged
The report gives no description here.
LowImpossible to set reportProcessor if the initial epoch is in the futureAcknowledged
The report gives no description here.
LowLimits for max depositsAcknowledged
The report gives no description here.
LowMissing length check in loadKeysSigs()Acknowledged
The report gives no description here.
LowNarrow rangeAcknowledged
The report gives no description here.
LowNo appropriate eventAcknowledged
The report gives no description here.
LowNo check for _etherToLockOnWithdrawalQueueAcknowledged
The report gives no description here.
LowNo checks for a different values in the setter functionsAcknowledged
The report gives no description here.
Show 10 more
LowNo checks for node operator id and validator indexAcknowledged
The report gives no description here.
LowNo post deposit root checkAcknowledged
The report gives no description here.
LowPossibility to deposit the same validator addressAcknowledged
The report gives no description here.
LowPossible overflowAcknowledged
The report gives no description here.
LowPossible risk of DOS via ETH sending into Consensus LayerAcknowledged
The report gives no description here.
LowPrefinalize SLOAD reductionAcknowledged
The report gives no description here.
LowRange restrictionAcknowledged
The report gives no description here.
LowRedundant checkpoint checkAcknowledged
The report gives no description here.
LowRedundant type castingAcknowledged
The report gives no description here.
LowSanityChecker includes withdrawn ether from past reportsAcknowledged
The report gives no description here.
Show 5 more
LowSoft requirement for transferAcknowledged
The report gives no description here.
LowStakingRouter can return exited validators that hasn't been updatedAcknowledged
The report gives no description here.
LowStuck validators updateAcknowledged
The report gives no description here.
LowUncertain reward withdrawalAcknowledged
The report gives no description here.
LowUnused function parametersAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 11 reports · latest Jun 2026
See Statemind’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us