Lido Community Staking Module audit (October 2024)
Ackee Blockchain Security reviewed Lido (Lido Community Staking Module audit (October 2024)) on 12 Oct 2024: 9 findings, 0 critical; 6 marked fixed, 3 acknowledged.
Findings9
Statuses are the security firm’s own, from its report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 0 | 0 |
| High | 0 | 0 | 0 |
| Medium | 0 | 0 | 1 |
| Low | 0 | 3 | 5 |
Marked Info or Warning by the firm. Not counted as findings.
WarningInconsistencies in setting consensus version in BaseOracleOpen
The report gives no description here.
InfoUnused codeOpen
The report gives no description here.
InfoAssetRecoverer does not allow specifying the amount in the recoverEther functionAcknowledged
The report gives no description here.
InfoCSBondCore._getClaimableBon dShares should be unimplementedAcknowledged
The report gives no description here.
WarningEIP-7002 mandatory for CSMAcknowledged
The report gives no description here.
InfoHashConsensus condition never metAcknowledged
The report gives no description here.
WarningNode operator may withdraw before execution layer stealing reportedAcknowledged
The report gives no description here.
WarningPermissionless queue clearingAcknowledged
The report gives no description here.
WarningPermissionless unpausable functionsAcknowledged
The report gives no description here.
WarningprocessOracleReport check prevents fixing mistakesAcknowledged
The report gives no description here.
Show 10 more
InfopullFeeRewards does not update depositable keys countAcknowledged
The report gives no description here.
InfoCSBondCore._claimStETH function unnecessarily calls the _ethByShares function when emitting eventFixed
The report gives no description here.
Warningdepositable > enqueued blocking Staking RouterFixed
The report gives no description here.
WarningDirty memory bytes in Validator SSZ serializationFixed
The report gives no description here.
WarningEvent inconsistenciesFixed
The report gives no description here.
WarningFixed withdrawal credentials in CSVerifierFixed
The report gives no description here.
InfoHashConsensus should inherit from IConsensusContractFixed
The report gives no description here.
WarningInconsistent _onlyRecoverer function implementationFixed
The report gives no description here.
InfoInconsistent higher bits clearing in QueueLibFixed
The report gives no description here.
InfoIncorrect documentation & typosFixed
The report gives no description here.
Show 10 more
InfoInterfaces outside of dedicated folderFixed
The report gives no description here.
WarningMissing curveId checkFixed
The report gives no description here.
InfoQueueLib.clean return last index of cleared itemFixed
The report gives no description here.
InfoRedundant whenPaused checkFixed
The report gives no description here.
InfoState variable read multiple timesFixed
The report gives no description here.
WarningtargetLimitMode loose check in updateTargetValidatorsLimit sFixed
The report gives no description here.
WarningtargetLimitMode set to 0 not clearing targetLimitFixed
The report gives no description here.
Infotype GIndex should have pow() function availableFixed
The report gives no description here.
WarningUnchecked blocksFixed
The report gives no description here.
WarningVersioned contracts can be initialized to zero versionFixed
The report gives no description here.
Contracts in scope
No deployed address is recorded for this audit.
The report names a repository or files. Open the report to see its scope.
Part of Lido’s security record
LidoSecurity firm
Ackee Blockchain Security39 projects reviewed · 81 reports · latest Jul 2026
See Ackee Blockchain Security’s auditsSomething wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us