Lido Vault Middleware Audit Report

Cyfrin19 Dec 2025Code version: not recorded (see the report)

Audit · firm’s term: audit report

Cyfrin reviewed Lido (Lido Vault Middleware Audit Report) on 19 Dec 2025: 5 findings, 0 critical; all marked fixed.

No open critical findings

Open the report Open Lido’s security record

Report hosted on GitHub.

Trustblock does not review code.

Findings5

Statuses are the security firm’s own, from its report.

Severity	Open	Acknowledged	Fixed
Critical	0	0	0
High	0	0	0
Medium	0	0	0
Low	0	0	5

LowEmergencyVault::activateRecovery can be DoS by a reverting TAR- GET_VAULT callsFixed

The report gives no description here.

LowERC4626Adapter::maxMint doesn’t consider pending fees to be harvested which leads to under-calculating the real shares that can be mintedFixed

The report gives no description here.

LowERC4626Adapter::maxMint reverts for uncapped target vaultsFixed

The report gives no description here.

LowGriefing attack on depositors by manipulating the exchange rate during recoveryMode via a donation of TARGET_VAULTs shares in between emergencyMode and recoveryModeFixed

The report gives no description here.

LowNon-compliant events emitted on vault deposits and withdrawalsFixed

The report gives no description here.

Contracts in scope

No deployed address is recorded for this audit.

The report names a repository or files. Open the report to see its scope.

Part of Lido’s security record

Lido

Audits54 audits by 13 firmsLast audit Sep 2026, by Composable Security.

Critical findings2 criticals acknowledged, not fixedReported in 2 reports, the latest by Statemind, Apr 2023. The team acknowledged both.

Open Lido’s security record

Security firm

Cyfrin

28 projects reviewed · 79 reports · latest Sep 2026

See Cyfrin’s audits

Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.