Lido security record
As of 24 Oct 2026, Lido has 53 audit reports by 13 security firms on Trustblock; the latest is by Composable Security, dated 9 Sep 2026. Those reports list 2 criticals acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits53
Newest first
1 other security report listed, not counted
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Lido Community Staking Module audit (October 2024) | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Zircuit / Lido / NEW Proposal | Security firm: Quantstamp | Date: | Scope: Files named in the report | No open critical findings | Open · certificate.quantstamp.com |
| Lido Staking Router V2 | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Simple Delegation | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| LIP-23: Rebase Check Smart Contracts | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Lido Steth Optimism | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Simple Delegation security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Stonks | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Simple DVT Easy Track Factories security revi | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido EasyTrack | Security firm: OXORIO | Date: | Scope: Repository at commit 425f4a2 | No open critical findings | Open · audits.oxor.io |
| Lido V2 Upgrade Template security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido V2 on chain | Security firm: OXORIO | Date: | Scope: Repository at commit e45c4d6 | No open critical findings | Open · IPFS |
| Lido V2 security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | 1 critical acknowledged, not fixed | Open · GitHub |
| GateSeals security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido security review | Security firm: Hexens | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Lido on Polygon RequestWithdraw Fix | Security firm: OXORIO | Date: | Scope: Repository at commit da2e7ee | 1 critical finding, fixed | Open · audits.oxor.io |
| Lido dc4bc security assessment (v2. | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Staking Router | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| TRP Vesting Escrow security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Easy Track Payment Processor with limits 09-2022 s | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| MEV-Boost relay allowlist Security security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido V1 | Security firm: ChainSecurity | Date: | Scope: Files named in the report | No open critical findings | Open · chainsecurity.com |
| Lido Governance Crosschain Bridges | Security firm: OXORIO | Date: | Scope: Repository at commit 8fa25b0 | No open critical findings | Open · audits.oxor.io |
| Lido L2 | Security firm: OXORIO | Date: | Scope: Repository at commit 082e7eb | 1 critical acknowledged, not fixed | Open · audits.oxor.io |
| Lido Jumpgate | Security firm: OXORIO | Date: | Scope: Repository at commit 0802ae1 | No open critical findings | Open · audits.oxor.io |
Findings591
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 2 | 12 |
| High | 0 | 3 | 32 |
| Medium | 0 | 20 | 73 |
| Low | 1 | 160 | 288 |
CriticalFunds stealing by malicious staking moduleLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportCriticalUser looses their funds if maxSubmissionCost is lowLido L2 · OXORIO · 21 Jul 2022Acknowledged
The report gives no description here.
Open the reportHighA Node Operator can circumvent DAO validator key approvalLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportHighThe parameter depositCalldata can be hijacked by a front-runLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportHighPossible griefing attack to cancel motionsEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportMediumPerformance Web Server publicly bound by default with no authentication, authorization or rate limitingLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportMediumStaking limits bypass via external ether rebalancingLido V3 · Certora · 10 Jan 2026Acknowledged
The report gives no description here.
Open the reportMedium[CSM] A new Node Operator can migrate via migrateToPriorityQueueTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportMedium[CSM] Double counting of enqueued keys after using CSModule.migrateToPriorityQueue()Triggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportMediumGriefing TriggerableWithdrawalsGateway limitsTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
MediumUsers may not get ProposalTimelock days to veto ProposalsLido DG · Certora · 5 Feb 2025Acknowledged
The report gives no description here.
Open the reportMediumZero ratio after rounding during division in NGOLisLaunchnodes Lido Liquid Staking · OXORIO · 13 Dec 2024Acknowledged
The report gives no description here.
Open the reportMediumInfinity approval to Withdrawal Queue may present problems for Escrow and DG systemDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportMediumCross-token limit works correctly only with stablecoins in TopUpAllowedRecipientsLido EasyTrack · OXORIO · 18 Oct 2023Acknowledged
The report gives no description here.
Open the reportMediumA single staking module can block whole depositsLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumDeposits through DepositSecurityModule can be blocked by front-runLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumExcessive penaltyLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumFastLane length change leads to the disruption of the voting logicLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumManipulating active validators countLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumQuorum change leads to the disruption of the voting logicLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
MediumRestriction of total feeLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumWithdrawn stETH is not fully burntLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumDEPOSIT CALL DATA NOT INCLUDED IN GUARDIAN SIGNATURELido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportMediumGuardian may cancel updateGuardianLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportMediumPossible to execute expired actionSet in the futureLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowUnreachable branch in the submit delay calculationLido Oracle V8_1 security review · Composable Security · 9 Sep 2026Acknowledged
The report gives no description here.
Open the reportLowDaily spend cap straddlingLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowEmpty revert data breaks observer isolationLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowTimed price mismatch in buyback budgetLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportLowUnconverted Revenue Excluded From BaselinesLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowBaseModule.updateDepositInfo() and BaseModule.updateDepositableValidatorsCount() lack an operatorexistence checkLido CSM v3 and CM v2 security review · Statemind · 30 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowDeprecated referrer parameter is still accepted and emittedLido CSM v3 and CM v2 security review · Statemind · 30 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowExitPenalties.processExitDelayReport() and ExitPenalties.processTriggeredExit() do not verify pubkey & node operator bindingLido CSM v3 and CM v2 security review · Statemind · 30 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowGrouped operator can be configured with zero shareLido CSM v3 and CM v2 security review · Statemind · 30 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowInline role check without dedicated wrapper functionLido CSM v3 and CM v2 security review · Statemind · 30 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowRedundant storage writes and events on unchanged parameter updatesLido CSM v3 and CM v2 security review · Statemind · 30 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowEnd-of-period validator balances attributed across earlier frames for fee distributionLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowExit order share-rate predicate uses absolute excess instead of relative deviationLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowPer-report exit limit overcounts compounding validators that have not been topped upLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowRemove redundant consolidating as source guard in exit predicatesLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowRemove slashed validators from network performance aggregateLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowStaking module performance state initialization crashes when epochs_per_frame is reconfiguredLido Oracle V8 security review · Composable Security · 24 Jun 2026Acknowledged
The report gives no description here.
Open the reportLowConsolidations create inconsistencies in CMv2 key balance accountingLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportLowInitial deposit allocator's count-based fairness math systematically biases CMv2 stake distributionLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportLowkeyConfirmedBalance can be stale in case of prover failure, leading to incorrect withdrawal report penalty accountingLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportLowTop ups to validators that are in exit queue, create 2 valid withdrawal requestsLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportLowIf shares rate is less than 1 anyone can transfer shares from anyone elseLido V3 · Certora · 10 Jan 2026Acknowledged
The report gives no description here.
Open the reportLowSolidity 0.4.24 allocates more memory than neededLido V3 · Certora · 10 Jan 2026Acknowledged
The report gives no description here.
Open the reportLowSetting IPFS parameters explicitlyLido Oracle V7 security review · Composable Security · 12 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowUse expiration time for auth tokensLido Oracle V7 security review · Composable Security · 12 Dec 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowKubo RPC API Bound to 0.0.0.0Lido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowLack of Validation in Event HandlingLido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowMerkle Tree Validation Missing Leaf CountLido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowMissing IPFS Data ValidationLido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportLowPrometheus Server Bound to 0.0.0.0Lido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportLow[CSM] Keys removal logic can be optimizedTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportLow[CSM] Sanity check for referralCurveIdTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportLow[CSM] Unclear settlement and compensation timingsTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportLowExtra check in the NodeOperatorsRegistry.reportValidatorExitDelay() functionTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportLowRedundant version checkTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowWithdrawal delays may lead to unjust penaltiesTriggerable Withdrawals and CSM v2 security review · Statemind · 19 Sep 2025Acknowledged
The report gives no description here.
Open the reportLowAvoiding strikes penaltyLido Oracle V6 security review · Composable Security · 21 Aug 2025Acknowledged
The report gives no description here.
Open the reportLowUnfair validator performance checkLido Oracle V6 security review · Composable Security · 21 Aug 2025Acknowledged
The report gives no description here.
Open the reportLowCheck for fastLane member can be bypassed while consensus disabledLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportLowDiscard logic of report may never be usedLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportLowSingle leaf rewards pullingLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportLowLack of rounding epoch to frame in rebase border epoch calculationLido Oracle v5 04-25 security review · Composable Security · 7 Apr 2025Acknowledged
The report gives no description here.
Open the reportLowLoss of rewards in case of omitted frameLido Oracle v5 04-25 security review · Composable Security · 7 Apr 2025Acknowledged
The report gives no description here.
Open the reportLowInconsistent Use of Zero-Address ChecksLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Acknowledged
The report gives no description here.
Open the reportLowResealManager Could Make Use of SealableCalls LibraryLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowMissing functionality for mistaken tokens and ETH withdrawal in NGOLisLaunchnodes Lido Liquid Staking · OXORIO · 13 Dec 2024Acknowledged
The report gives no description here.
Open the reportLowAbility to Vote Multiple Times on the Same Proposal in Tiebreaker ContractsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Acknowledged
The report gives no description here.
Open the reportLowEscrow.requestNextWithdrawalsBatch Might Be Executed While the Batch Queue Is in a Closed StateLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Acknowledged
The report gives no description here.
Open the reportLowIncorrect Comparison Used for Tiebreaker VotingLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Acknowledged
The report gives no description here.
Open the reportLowAdd system limit for number of proposersDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowCheck for proposal.status in ExecutableProposals._isProposalMarkedCancelled() is required only in one caseDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowChecking arrays' lengthDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowEmergency protection can last longer than MAX_EMERGENCY_PROTECTION_DURATIONDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowEnsure that updating DualGovernance.configProvider doesn't affect the current state of DualGovernanceStateMachineDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowRage Quit support changes due to stETH rebalancesDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowRe-writing address of the Rage EscrowDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowRedundant governance config validity checkDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowRedundant nonce checkDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowSanity check for Emergency governance and usual GovernanceDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowSanity check for timelock delaysDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowSanity checks for Emergency committeesDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowUsers can unlock only the entire balanceDual Governance security review · Statemind · 25 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowCheck for fastLane member can be bypassed while consensus disabledLido Community Staking Module audit (October 2024) · Ackee Blockchain Security · 12 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowDiscard logic of report may never be usedLido Community Staking Module audit (October 2024) · Ackee Blockchain Security · 12 Oct 2024Acknowledged
The report gives no description here.
Open the reportLowSingle leaf rewards pullingLido Community Staking Module audit (October 2024) · Ackee Blockchain Security · 12 Oct 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowDuplicate voters addresses can be passed to attemptVoteForMultipleLido Simple Delegation security review · Statemind · 12 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowExcessive check in Voting._isVoteOpen()Lido Simple Delegation security review · Statemind · 12 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowInconsistency in Voting.canVote() functionLido Simple Delegation security review · Statemind · 12 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowLack of minimum and maximum Voting and Objection timeLido Simple Delegation security review · Statemind · 12 Mar 2024Acknowledged
The report gives no description here.
Open the reportLowGeneral architectural guidelineLido Simple DVT Easy Track Factories security revi · Statemind · 24 Dec 2023Acknowledged
The report gives no description here.
Open the reportLowInconsistent type of stakingLimitLido Simple DVT Easy Track Factories security revi · Statemind · 24 Dec 2023Acknowledged
The report gives no description here.
Open the reportLowIncreaseVettedValidatorsLimit can temporarily block the addition of a new motion to EasyTrackLido Simple DVT Easy Track Factories security revi · Statemind · 24 Dec 2023Acknowledged
The report gives no description here.
Open the reportLowFloating pragma in the contracts of the scopeLido EasyTrack · OXORIO · 18 Oct 2023Acknowledged
The report gives no description here.
Open the reportLowGas optimization of the _recipients.length in TopUpAllowedRecipientsLido EasyTrack · OXORIO · 18 Oct 2023Acknowledged
The report gives no description here.
Open the reportLowMissing zero address validation in multiple contractsLido EasyTrack · OXORIO · 18 Oct 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowEOA has access to change implementations before the startUpgradeLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLowGas efficent constantsLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLowGas optimizationLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLowLoop gas optimizationLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLowMissing dummyImplementation checkLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLowNot deployed dummy implementationLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLowRedundant local variableLido V2 Upgrade Template security review · Statemind · 10 May 2023Acknowledged
The report gives no description here.
Open the reportLow_checkAnnualBalancesIncrease() doesn't include withdrawn etherLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLow"Bunker mode" withdrawal implementationLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowActive node operator checkLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowAffecting on burn requestLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowAvoiding heavy computationsLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowClaim SLOAD reductionLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowConsecutively emitting identical eventsLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowDEADLINE_SLOT_OFFSETLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowDepositable ether zero checkLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowExtra if statement in _checkConsensus methodLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowGas optimizationLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowGas optimization: MinAllocationLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowImpossible to set reportProcessor if the initial epoch is in the futureLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowLimits for max depositsLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowMissing length check in loadKeysSigs()Lido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowNarrow rangeLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowNo appropriate eventLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowNo check for _etherToLockOnWithdrawalQueueLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowNo checks for a different values in the setter functionsLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowNo checks for node operator id and validator indexLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowNo post deposit root checkLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowPossibility to deposit the same validator addressLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowPossible overflowLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowPossible risk of DOS via ETH sending into Consensus LayerLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowPrefinalize SLOAD reductionLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowRange restrictionLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowRedundant checkpoint checkLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowRedundant type castingLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowSanityChecker includes withdrawn ether from past reportsLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowSoft requirement for transferLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowStakingRouter can return exited validators that hasn't been updatedLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowStuck validators updateLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowUncertain reward withdrawalLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowUnused function parametersLido V2 security review · Statemind · 28 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowThe need to repeat the transactionGateSeals security review · Statemind · 20 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowADDING A NODE OPERATOR DOES NOT INCREASE THE NONCELido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowANYONE CAN ALWAYS TRANSFER 1 WEI STETHLido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowFRONTRUNNING INITIALISATIONLido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowGAS OPTIMISATION OF CANDEPOSITLido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowGAS OPTIMISATION OF WITHDRAWAL QUEUE INITIALISATIONLido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowMISSING TWO-STEP OWNERSHIP TRANSFERRALLido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowREDUNDANT STORAGE WRITELido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportLowUSERS WOULD LOSE THEIR FUNDS IF CLAIMING A WITHDRAWAL REQUEST DIRECTLY TO LIDOLido security review · Hexens · 14 Apr 2023Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowExcessive Memory AllocationsLido Staking Router · ChainSecurity · 3 Feb 2023Acknowledged
The report gives no description here.
Open the reportLowRounding ErrorsLido Staking Router · ChainSecurity · 3 Feb 2023Acknowledged
The report gives no description here.
Open the reportLowUnnecessary Reduction of Vetted Key CountLido Staking Router · ChainSecurity · 3 Feb 2023Acknowledged
The report gives no description here.
Open the reportLowRedundant argumentTRP Vesting Escrow security review · Statemind · 27 Jan 2023Acknowledged
The report gives no description here.
Open the reportLowEvent parameter can be indexedEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowGas optimization by replacing memory with calldataEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowInconsistent naming of function parametersEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowIncorrect NatSpec commentsEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowNo checks for address zeroEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowNode operator can spamEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowPossible to create a motion with transfer amount bigger than single transfer limitEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowVariables can be immutableEasy Track Payment Processor with limits 09-2022 s · Statemind · 30 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowInefficient storage of relaysMEV-Boost relay allowlist Security security review · Statemind · 9 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowRedundant checkMEV-Boost relay allowlist Security security review · Statemind · 9 Sep 2022Acknowledged
The report gives no description here.
Open the reportLowGas InefficienciesLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowInconsistent Event OrderLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowLidoOracle Initialized With Wrong EpochLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowMalicious Node OperatorsLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowmemcpy OptimizationsLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowNo Events on Important State ChangesLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportShow 10 more
LowsharesAmount Can Be ZeroLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowTyping ErrorsLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowUnused ImportsLido V1 · ChainSecurity · 23 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowA struct can be introduced to improve readabilityLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowChanging gracePeriod may change actionSets' statusesLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowdelegatecall may be unnecessaryLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowDenying duplicate actions may be redundantLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowExecution ordering may be unexpectedLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowQueue and deposit requires several government actionsLido Governance Crosschain Bridges · OXORIO · 15 Aug 2022Acknowledged
The report gives no description here.
Open the reportLowRedundant checksLido L2 · OXORIO · 21 Jul 2022Acknowledged
The report gives no description here.
Open the reportShow 5 more
LowTransaction censoring is possibleLido L2 · OXORIO · 21 Jul 2022Acknowledged
The report gives no description here.
Open the reportLowOwner has ability to get all the tokensLido Jumpgate · OXORIO · 4 May 2022Acknowledged
The report gives no description here.
Open the reportLowInconsistent naming for ValidatorProxy.operator variableAcknowledged
The report gives no description here.
LowMisleading revert message in case of pending fundsAcknowledged
The report gives no description here.
LowNot descriptive variable name token2IndexAcknowledged
The report gives no description here.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lido"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us