Triggerable Withdrawals and CSM v2 security review
Statemind reviewed Lido (Triggerable Withdrawals and CSM v2 security review) on 19 Sep 2025: 26 findings, 0 critical; 17 marked fixed, 9 acknowledged.
Findings26
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 3 | 2 |
| Low | 0 | 6 | 15 |
Medium[CSM] CSModule.getNodeOperatorSummary() does not cover all casesFixed
The report gives no description here.
MediumPenalties for invalid requestsFixed
The report gives no description here.
Low[CSM] CSBondLock.MIN_BOND_LOCK_PERIOD can be zeroFixed
The report gives no description here.
Low[CSM] Following Checks-Effects-Interactions pattern when interacting with TriggerableWithdrawalsGatewayFixed
The report gives no description here.
Low[CSM] Gas optimizationsFixed
The report gives no description here.
Low[CSM] Misleading commentFixed
The report gives no description here.
Low[CSM] Missing NatSpec in constructorFixed
The report gives no description here.
Low[CSM] Missing sanity check in NOAddresses.changeNodeOperatorRewardAddress()Fixed
The report gives no description here.
LowExtra check in the ValidatorExitDelayVerifier._getExitRequestDeliveryTimestamp() functionFixed
The report gives no description here.
LowGas optimizationFixed
The report gives no description here.
Show 7 more
LowGas optimizationsFixed
The report gives no description here.
LowInconsistent exit requests eventsFixed
The report gives no description here.
LowIncorrect comparison in ValidatorExitDelayVerifier._getSecondsSinceExitIsEligible() functionFixed
The report gives no description here.
LowIncorrect NatSpecFixed
The report gives no description here.
LowMissing AccountingOracle version updateFixed
The report gives no description here.
LowRedundant components in the TriggerableWithdrawalsGateway contractFixed
The report gives no description here.
LowTriggerable exits do not increment TOTAL_REQUESTS_PROCESSED_POSITIONFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
1 project reviewed · 11 reports · latest Jun 2026
See Statemind’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us