Dual Governance security review
Statemind reviewed Lido (Dual Governance security review) on 25 Oct 2024: 46 findings, 0 critical; 32 marked fixed, 14 acknowledged.
Findings46
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 1 | 3 |
| Low | 0 | 13 | 29 |
MediumIncorrect configuration of MAX_EMERGENCY_PROTECTION_DURATIONFixed
The report gives no description here.
MediumIncorrect deployment can break TiebreakerCoreCommitteeFixed
The report gives no description here.
MediumPossible DG state change due to unstETH finalizationFixed
The report gives no description here.
LowAbsence of zero checkFixed
The report gives no description here.
LowAdditional check when converting to IndexOneBased typeFixed
The report gives no description here.
LowConsistency in using Timestamps.now()Fixed
The report gives no description here.
LowDefine functions as external in HashConsensusFixed
The report gives no description here.
LowEscrowState.setMinAssetsLockDuration() can be called out of initializationFixed
The report gives no description here.
LowEvent emission for unfinalized recordsFixed
The report gives no description here.
LowGas optimisationsFixed
The report gives no description here.
Show 10 more
LowHashConsensus._getHashState() doesn't return historical quorum and supportFixed
The report gives no description here.
LowImprecise conditions for pause check in ResealManagerFixed
The report gives no description here.
LowInconsistent naming in Escrow contract and interfaceFixed
The report gives no description here.
LowInconsistent result of the DualGovernance state view functionsFixed
The report gives no description here.
LowIncorrect natspecFixed
The report gives no description here.
LowMissing constructor check for TiebreakerActivationTimeoutFixed
The report gives no description here.
LowMissing parameter sanity checksFixed
The report gives no description here.
LowMissing zero checksFixed
The report gives no description here.
LowNo sanity check of SanityCheckParamsFixed
The report gives no description here.
LowProposalType.ResumeSealable is not included in encoding dataFixed
The report gives no description here.
Show 10 more
LowProposer is not saved in proposal dataFixed
The report gives no description here.
LowRedundant storage arrayFixed
The report gives no description here.
LowRedundant underflow checksFixed
The report gives no description here.
LowSome custom errors are never used and incorrect error name is usedFixed
The report gives no description here.
LowThe WithdrawalsBatchesQueue functions improvementsFixed
The report gives no description here.
LowTiebreaker condition inconsistencyFixed
The report gives no description here.
LowTimelockedGovernance.executeProposal() is not part of IGovernance interfaceFixed
The report gives no description here.
LowUninitialized TimelockState after deploymentFixed
The report gives no description here.
LowunregisterProposer gas optimizationFixed
The report gives no description here.
LowUnused functions in SealableCallsFixed
The report gives no description here.
Show 2 more
LowUse >= instead of == in HashConsensus._vote()Fixed
The report gives no description here.
LowUse Timestamp type in EnumerableProposals.Proposal structureFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 11 reports · latest Jun 2026
See Statemind’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us