Triggerable Withdrawals and CSM v2 security review
Statemind reviewed Lido (Triggerable Withdrawals and CSM v2 security review) on 19 Sep 2025: 26 findings, 0 critical; 17 marked fixed, 9 acknowledged.
Findings26
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 3 | 2 |
| Low | 0 | 6 | 15 |
Medium[CSM] A new Node Operator can migrate via migrateToPriorityQueueAcknowledged
The report gives no description here.
Medium[CSM] Double counting of enqueued keys after using CSModule.migrateToPriorityQueue()Acknowledged
The report gives no description here.
MediumGriefing TriggerableWithdrawalsGateway limitsAcknowledged
The report gives no description here.
Low[CSM] Keys removal logic can be optimizedAcknowledged
The report gives no description here.
Low[CSM] Sanity check for referralCurveIdAcknowledged
The report gives no description here.
Low[CSM] Unclear settlement and compensation timingsAcknowledged
The report gives no description here.
LowExtra check in the NodeOperatorsRegistry.reportValidatorExitDelay() functionAcknowledged
The report gives no description here.
LowRedundant version checkAcknowledged
The report gives no description here.
LowWithdrawal delays may lead to unjust penaltiesAcknowledged
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 11 reports · latest Jun 2026
See Statemind’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us