Lido V2 security review
Statemind reviewed Lido (Lido V2 security review) on 28 Apr 2023: 120 findings, 2 critical; 75 marked fixed, 45 acknowledged.
Findings120
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 1 | 1 |
| High | 0 | 2 | 6 |
| Medium | 0 | 8 | 9 |
| Low | 0 | 34 | 59 |
CriticalReentrancy in depositing buffered etherFixed
The report gives no description here.
HighIncorrect require leads to DOSFixed
The report gives no description here.
HighNot matching interfaceFixed
The report gives no description here.
HighStaking module can block withdrawal credential changing and oracleFixed
The report gives no description here.
HighWithdrawal NFT burning after transfer to selfFixed
The report gives no description here.
HighWrong NFT balanceFixed
The report gives no description here.
HighZero deposits allocation after the pause the one of staking modulesFixed
The report gives no description here.
MediumBlocking rewards distributionFixed
The report gives no description here.
MediumNo check for return value size in isValidSignature()Fixed
The report gives no description here.
MediumNodeOperatorsRegistry keys nonce doesn't changeFixed
The report gives no description here.
Show 10 more
MediumPossible to set stuck/exited validators count to be bigger than depositedFixed
The report gives no description here.
MediumPossible to submit report extra data in the next frame after the reportFixed
The report gives no description here.
MediumreportProcessor can have a report that doesn't reach a consensusFixed
The report gives no description here.
MediumWrong Burnt shares calculationFixed
The report gives no description here.
MediumWrong burntWithdrawalsShares calculationFixed
The report gives no description here.
MediumWrong offsets for stuck and refunded validatorsFixed
The report gives no description here.
LowActive validators calculationFixed
The report gives no description here.
LowArray length checkFixed
The report gives no description here.
LowArray length checkFixed
The report gives no description here.
LowBinary search boundaryFixed
The report gives no description here.
Show 10 more
LowCheck arrays lengthFixed
The report gives no description here.
LowclearNodeOperatorPenalty() can be restricted to externalFixed
The report gives no description here.
LowCode duplicationFixed
The report gives no description here.
LowDivision before multiplicationFixed
The report gives no description here.
LowExited validators count might be bigger than total depositedFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
Show 10 more
LowGas optimization for unlimited allowanceFixed
The report gives no description here.
LowGuard checks for zero secondsPerSlotFixed
The report gives no description here.
LowHardcoded StakingModule limitFixed
The report gives no description here.
LowImproper commentsFixed
The report gives no description here.
LowInconsistent input string for role hashFixed
The report gives no description here.
LowIncorrect checkFixed
The report gives no description here.
LowIncorrect information in the commentFixed
The report gives no description here.
LowInsufficient if statement in WithrawalQueueBase contractFixed
The report gives no description here.
LowLack of zero address checkFixed
The report gives no description here.
LowMissing checks for _requestId out of rangeFixed
The report gives no description here.
Show 10 more
LowMissing zero check when reporting minted rewardsFixed
The report gives no description here.
LowModifier doesn't guarantee anything, default enum statusFixed
The report gives no description here.
LowMultiple transfers of stETH token instead of a single transferFixed
The report gives no description here.
LowNo check on the refSlot in submitting a ConsensusReportFixed
The report gives no description here.
LowNo zero check for _maxPositiveTokenRebaseFixed
The report gives no description here.
LowNon-callable functionFixed
The report gives no description here.
LowPayable ownerFixed
The report gives no description here.
LowPenalty delay typeFixed
The report gives no description here.
LowPossible underflow in trimUint256Array()Fixed
The report gives no description here.
LowPrecise calculationsFixed
The report gives no description here.
Show 10 more
LowRedundant onlyRole modifierFixed
The report gives no description here.
LowRedundant v component checkFixed
The report gives no description here.
LowRequest owner should not be payableFixed
The report gives no description here.
LowRoles mismatchingFixed
The report gives no description here.
LowState mutabilityFixed
The report gives no description here.
LowState mutability can be restricted to viewFixed
The report gives no description here.
LowStuck penalty delay extensionFixed
The report gives no description here.
LowTransfer of instructions necessary for initializationFixed
The report gives no description here.
LowType mismatchFixed
The report gives no description here.
LowTypo in _addSigningKeys()Fixed
The report gives no description here.
Show 10 more
LowTypo in commentFixed
The report gives no description here.
LowUnable to get a consensus state if the quorum is unreachableFixed
The report gives no description here.
LowUnclear commentsFixed
The report gives no description here.
LowUnclear purpose of limits in Sanity CheckerFixed
The report gives no description here.
LowUnnecessary variableFixed
The report gives no description here.
LowUnsafe castingFixed
The report gives no description here.
LowUnsafe mathFixed
The report gives no description here.
LowUnsafe memory handling in getStakingRewardsDistribution()Fixed
The report gives no description here.
LowUnused errorsFixed
The report gives no description here.
LowUnused return valueFixed
The report gives no description here.
Show 5 more
LowUpdating variables after external calls and transfersFixed
The report gives no description here.
LowUseless payable conversion for callFixed
The report gives no description here.
LowWithdrawal finalization before actual shares burnFixed
The report gives no description here.
LowWrong comment in DepositSecurityModuleFixed
The report gives no description here.
LowWrong event argumentFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 11 reports · latest Jun 2026
See Statemind’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us