Lido security record
As of 24 Oct 2026, Lido has 53 audit reports by 13 security firms on Trustblock; the latest is by Composable Security, dated 9 Sep 2026. Those reports list 2 criticals acknowledged and not fixed.
Record last updated . It holds audits and findings, contracts and incidents up to Oct 2026. Trustblock does not review code.
Audits53
Newest first
1 other security report listed, not counted
| Audit | Security firm | Date | Scope | Critical findings | Report |
|---|---|---|---|---|---|
| Lido Oracle V8_1 security review | Security firm: Composable Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido NEST | Security firm: ack3 | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido CSM v3 and CM v2 security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Oracle V8 security review | Security firm: Composable Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Circuit Breaker Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Original removed |
| Lido PR 85 - Bytecode Verification | Security firm: Cantina | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · cantina.xyz |
| Lido CSM v3 and CM v2 audit | Security firm: Certora | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Vault Wrapper | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido V3 Formal verification · firm’s term: formal verification | Security firm: Certora | Date: | Scope: Not recorded (see the report) | 1 critical finding, fixed | Open · GitHub |
| Lido security review | Security firm: Sigma Prime | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Vault Middleware Audit Report | Security firm: Cyfrin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Stonks 2. | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Oracle V7 security review | Security firm: Composable Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido V3 Oracle V7 | Security firm: Certora | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Triggerable Withdrawals and CSM v2 security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Triggerable Withdrawals | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Csm V2 | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Oracle V6 security review | Security firm: Composable Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Community Staking Module audit (April 2025) | Security firm: Ackee Blockchain Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Oracle v5 04-25 security review | Security firm: Composable Security | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido Dual Governance re-audit Version of an earlier report: counted once with it | Security firm: OpenZeppelin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Lido DG Audit · Includes formal verification | Security firm: Certora | Date: | Scope: Not recorded (see the report) | 2 critical findings, fixed | Open · GitHub |
| Launchnodes Lido Liquid Staking | Security firm: OXORIO | Date: | Scope: Files named in the report | 6 critical findings, fixed | Open · audits.oxor.io |
| Lido Dual Governance audit Audit · firm’s term: audit | Security firm: OpenZeppelin | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
| Dual Governance security review | Security firm: Statemind | Date: | Scope: Not recorded (see the report) | No open critical findings | Open · GitHub |
Findings591
Statuses are the security firm’s own, from each report.
| Severity | Open | Acknowledged | Fixed |
|---|---|---|---|
| Critical | 0 | 2 | 12 |
| High | 0 | 3 | 32 |
| Medium | 0 | 20 | 73 |
| Low | 1 | 160 | 288 |
Marked Warning, Info, Gas, Informational or Note by the firms. Not counted as findings.
InfoUnused codeLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Open
The report gives no description here.
Open the reportInfoUnused errorsLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Open
The report gives no description here.
Open the reportWarningInconsistencies in setting consensus version in BaseOracleLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Open
The report gives no description here.
Open the reportInfoUnused codeLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Open
The report gives no description here.
Open the reportNoteCode Quality ImprovementsLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Open
The report gives no description here.
Open the reportNoteIncorrect InterfacesLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Open
The report gives no description here.
Open the reportNoteDiscrepancies Between Documentation and ImplementationLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Open
The report gives no description here.
Open the reportWarningInconsistencies in setting consensus version in BaseOracleOpen
The report gives no description here.
InfoUnused codeOpen
The report gives no description here.
WarningChainlink phase upgrade price-read DoSLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportShow 10 more
WarningFront-runnable precomputed Stonks addressLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportInfoTreasury revenue undercount from per-module rounding dustLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportWarningValuation-blind LDO buyback cadenceLido NEST · ack3 · 24 Jul 2026Acknowledged
The report gives no description here.
Open the reportGasRedundant storage read of registry.pauser[_pausable] in Circuit- Breaker::pauseLido Circuit Breaker Audit Report · Cyfrin · 1 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalSingle pauser per pausable combined with heartbeat expiry lockout leaves zero emergency coverage during liveness gapsLido Circuit Breaker Audit Report · Cyfrin · 1 May 2026Acknowledged
The report gives no description here.
Open the reportInformationalExtended-mode changeNodeOperatorRewardAddress() lacks ownership confirmationLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportInformationalunstETH claim requires undocumented manual redemption step when rewardAddress is a passive contractLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Acknowledged
The report gives no description here.
Open the reportInfoUnused interfaces and librariesLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Acknowledged
The report gives no description here.
Open the reportInformationalThe value of fee shares may be too lowLido V3 · Certora · 10 Jan 2026Acknowledged
The report gives no description here.
Open the reportInformationalNot including _decimalsOffset when calculating the fee sharesLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
InformationalConsensus-critical contract methods should use finalized block by defaultLido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalDivision by Zero in get_steth_by_shares FunctionLido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationalOracle HTTP Provider follows HTTP Redirects (30x)Lido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportInformationaloz_merkle_tree Proof Verification on Internal Node (Informational)Lido V3 Oracle V7 · Certora · 10 Dec 2025Acknowledged
The report gives no description here.
Open the reportWarningDepositable validators count can be updated on non-existing node operatorsLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Acknowledged
The report gives no description here.
Open the reportWarningDuplicate getSigningKeys call in processBadPerformanceProofLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Acknowledged
The report gives no description here.
Open the reportInfoLido and StETH ambiguous namingLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Acknowledged
The report gives no description here.
Open the reportWarningMissing interface inheritanceLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Acknowledged
The report gives no description here.
Open the reportInfoAssetRecoverer does not allow specifying the amount in the recoverEther functionLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportInfoCSBondCore._getClaimableBon dShares should be unimplementedLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportShow 10 more
WarningEIP-7002 mandatory for CSMLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportInfoHashConsensus condition never metLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportWarningNode operator may withdraw before execution layer stealing reportedLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportWarningPermissionless queue clearingLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportWarningPermissionless unpausable functionsLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportWarningprocessOracleReport check prevents fixing mistakesLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportInfopullFeeRewards does not update depositable keys countLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Acknowledged
The report gives no description here.
Open the reportNoteUse calldata Instead of memoryLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Acknowledged
The report gives no description here.
Open the reportNoteGas OptimizationsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Acknowledged
The report gives no description here.
Open the reportNoteInconsistent Order Within ContractsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Acknowledged
The report gives no description here.
Open the reportShow 10 more
NoteLack of Security ContactLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Acknowledged
The report gives no description here.
Open the reportInfo_mintShares can return tokensAmount to save gasAcknowledged
The report gives no description here.
InfoAssetRecoverer does not allow specifying the amount in the recoverEther functionAcknowledged
The report gives no description here.
WarningChainlink feed registry mainnet-onlyAcknowledged
The report gives no description here.
InfoCSBondCore._getClaimableBon dShares should be unimplementedAcknowledged
The report gives no description here.
WarningDelegation does not expireAcknowledged
The report gives no description here.
WarningDivision rounding errorAcknowledged
The report gives no description here.
WarningEIP-7002 mandatory for CSMAcknowledged
The report gives no description here.
WarningERC-20 transferFrom emits ApprovalAcknowledged
The report gives no description here.
InformationalEVMScriptPermissions Gas Efficiency ConsiderationsAcknowledged
The report gives no description here.
Show 10 more
InfoHashConsensus condition never metAcknowledged
The report gives no description here.
WarningInconsistent attemptVoteForMultiple checksAcknowledged
The report gives no description here.
WarningInitializers can be front- runAcknowledged
The report gives no description here.
WarningLinear calculation of the allowed token rate deviationAcknowledged
The report gives no description here.
InformationalMessages May Be Sent to a Single NodeAcknowledged
The report gives no description here.
InformationalMessages May Be Sent to a Single NodeAcknowledged
The report gives no description here.
WarningNode operator may withdraw before execution layer stealing reportedAcknowledged
The report gives no description here.
InformationalObjections Allowed After Voting Duration ElapsedAcknowledged
The report gives no description here.
WarningOutdated Solidity versionAcknowledged
The report gives no description here.
WarningPausing deposits is susceptible to replayAcknowledged
The report gives no description here.
Show 10 more
WarningPermissionless queue clearingAcknowledged
The report gives no description here.
WarningPermissionless unpausable functionsAcknowledged
The report gives no description here.
WarningprocessOracleReport check prevents fixing mistakesAcknowledged
The report gives no description here.
InfopullFeeRewards does not update depositable keys countAcknowledged
The report gives no description here.
WarningRefunding validators can cause future failed exits unpenalizedAcknowledged
The report gives no description here.
InfoReserved keywordAcknowledged
The report gives no description here.
WarningStablecoins assumed stableAcknowledged
The report gives no description here.
WarningThe initializer can be front-runAcknowledged
The report gives no description here.
WarningThe initializer does not have validations for the correctness of _tokenAcknowledged
The report gives no description here.
WarningUsage of solc optimizerAcknowledged
The report gives no description here.
Show 10 more
WarningUsage of solc optimizerAcknowledged
The report gives no description here.
InfoIgnored slippage floors on full LP withdrawalsLido NEST · ack3 · 24 Jul 2026Fixed
The report gives no description here.
Open the reportInfoMissing interface inheritanceLido NEST · ack3 · 24 Jul 2026Fixed
The report gives no description here.
Open the reportInfoStaking router fee return type mismatchLido NEST · ack3 · 24 Jul 2026Fixed
The report gives no description here.
Open the reportGasEmit before state change to eliminate temporary variableLido Circuit Breaker Audit Report · Cyfrin · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationalMissing named mapping value parameters in Registry.StorageLido Circuit Breaker Audit Report · Cyfrin · 1 May 2026Fixed
The report gives no description here.
Open the reportGasSolidity optimizer is not enabledLido Circuit Breaker Audit Report · Cyfrin · 1 May 2026Fixed
The report gives no description here.
Open the reportInformationalBond lockPeriod documentation overpromises auto-unlockLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalETH bond path silently absorbs msg.value overpayment as additional bondLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalExpiredBondLockRemoved event not emitted when an expired bond lock gets overwritten by a new lockLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalgetNodeOperatorsCount, getActiveNodeOperatorsCount and getNodeOperatorIsActive have misleading names and functionalityLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInformationalRetroactive bond curve updates can silently unbond existing Node OperatorsLido CSM v3 and CM v2 audit · Certora · 17 Mar 2026Fixed
The report gives no description here.
Open the reportInfocalculateCurrentStethShareRate documentation contradicts implementation precisionLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfocreatePoolFinish forwards full msg.value instead of exact connect deposit potentially causing loss of overpaid ETHLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfoIncomplete documentation for checkpoint hint functionLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfoMisleading error name in GGVStrategyLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportWarningPossible type mismatch during calling BORING_QUEUE.requestOnChainWithdr awLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfoPotentially misleading reserveRatioBp variable nameLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfoPublic functions can be declared as externalLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfoRole constants read from Dashboard implementation instead of proxyLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportShow 10 more
WarningShares cannot be burnt when exceeding liability exists on pool and liability on vault is lowLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportWarningUnsafe transfer in recoverERC20 functionLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInfoUnused errorsLido Vault Wrapper · Ackee Blockchain Security · 6 Feb 2026Fixed
The report gives no description here.
Open the reportInformationalContract Requires Cancun EVM Version For mcopy OpcodeLido security review · Sigma Prime · 1 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalError Cases Not Returned To CallerLido security review · Sigma Prime · 1 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalLack Of returndatasize Validation In Precompile CallsLido security review · Sigma Prime · 1 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalRedundant Memory Write In Gas Optimized FunctionLido security review · Sigma Prime · 1 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalUndocumented Working Memory Allocation In AssemblyLido security review · Sigma Prime · 1 Jan 2026Fixed
The report gives no description here.
Open the reportInformationalEmergencyVault::activateRecovery NatSpec references wrong event nameLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIn Solidity don’t initialize to default valuesLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InformationalnonReentrant is not the first modifierLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportGasUse more efficient method of reading recipient account and basis pointsLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalUse named mappings to explicitly denote the purpose of keys and valuesLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportGasUse ReentrancyGuardTransient for faster nonReentrant modifiersLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalVault::decimals does not reflect correct decimals when OFFSET is usedLido Vault Middleware Audit Report · Cyfrin · 19 Dec 2025Fixed
The report gives no description here.
Open the reportWarningAmountConverter in the Stonks contract may not allow TOKEN_FROM and TOKEN_TOLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoassertQuotable inefficiencyLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoInconsistency in allowing manager to be zero addressLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoInefficient variable packingLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoMisleading event parameter nameLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
WarningMisleading use of errorsLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportWarningMissing ETH/USD feed configuration checkLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoMissing event emissionsLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoMissing public gettersLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoMissing TokenNotConfigured checkLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportWarningPRICE_UNIT and PRICE_SCALE discrepancyLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoRedundant MAX_DECIMALS checksLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInfoThe KillEngaged should not be emitted if the the Stonks contract was already killedLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportWarningToken decimals used as configured flagLido Stonks 2. · Ackee Blockchain Security · 12 Dec 2025Fixed
The report gives no description here.
Open the reportInformationalIncorrect Events Order Leads to Wrong Fees CalculationLido V3 Oracle V7 · Certora · 10 Dec 2025Fixed
The report gives no description here.
Open the reportShow 10 more
Warning_setExitDeadlineThreshold underflowLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarning_validateKeyNumberValueInte rvals in CSParametersRegistry does not check for empty arraysLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoCode optimizationsLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningDivision by zero in processBadPerformanceProofLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoInconsistent unchecked use in CSBondCurveLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningInvalid tagging of memory-safe assemblyLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoLack of context in deprecated function NatSpecLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoLack of event emissionLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningNode operator creation transient flag not clearedLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningNode operators can self-referLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportShow 10 more
WarningOutdated IConsensusContract interfaceLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningsubmitWithdrawals griefingLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoTyposLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningUnconditional emission of ReferralRecorded eventLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningUnimplemented function calledLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoUnused using-for directiveLido Triggerable Withdrawals · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportWarningValidatorWithdrawalInfo struct contains unused isSlashed fieldLido Csm V2 · Ackee Blockchain Security · 16 Sep 2025Fixed
The report gives no description here.
Open the reportInfoCSBondCore._claimStETH function unnecessarily calls the _ethByShares function when emitting eventLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningdepositable > enqueued blocking Staking RouterLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningDirty memory bytes in Validator SSZ serializationLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportShow 10 more
WarningEvent inconsistenciesLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningFixed withdrawal credentials in CSVerifierLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfoHashConsensus should inherit from IConsensusContractLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningInconsistent _onlyRecoverer function implementationLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfoInconsistent higher bits clearing in QueueLibLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfoIncorrect documentation & typosLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfoInterfaces outside of dedicated folderLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningMissing curveId checkLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfoQueueLib.clean return last index of cleared itemLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfoRedundant whenPaused checkLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportShow 10 more
InfoState variable read multiple timesLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningtargetLimitMode loose check in updateTargetValidatorsLimit sLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningtargetLimitMode set to 0 not clearing targetLimitLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportInfotype GIndex should have pow() function availableLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningUnchecked blocksLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportWarningVersioned contracts can be initialized to zero versionLido Community Staking Module audit (April 2025) · Ackee Blockchain Security · 8 Apr 2025Fixed
The report gives no description here.
Open the reportNoteIncomplete DocstringsLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Fixed
The report gives no description here.
Open the reportNoteMisleading DocumentationLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Fixed
The report gives no description here.
Open the reportNoteTypographical ErrorsLido Dual Governance re-audit · OpenZeppelin · 18 Feb 2025Fixed
The report gives no description here.
Open the reportNoteConfusing Variable NamesLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportShow 10 more
NoteDiscrepancies Between Interfaces and Implementation ContractsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteDuplicate Event EmissionsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteFile and Library Name MismatchLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteFunction Visibility Overly PermissiveLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteIncorrect Event Parameter NameLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteLack of Indexed Event Parameters for State ChangesLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteMissing Named Parameters in MappingsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteMissing Underflow Check in SharesValueLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteMultiple Library Declarations Per FileLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportNoteUnnecessary CastLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportShow 10 more
NoteUnused ErrorsLido Dual Governance audit · OpenZeppelin · 19 Nov 2024Fixed
The report gives no description here.
Open the reportInfoCache array lengthFixed
The report gives no description here.
InfoCSBondCore._claimStETH function unnecessarily calls the _ethByShares function when emitting eventFixed
The report gives no description here.
WarningDeclaration shadowingFixed
The report gives no description here.
Warningdepositable > enqueued blocking Staking RouterFixed
The report gives no description here.
WarningDirty memory bytes in Validator SSZ serializationFixed
The report gives no description here.
InfoDuplicated codeFixed
The report gives no description here.
InformationalEasyTrack Gas Saving ConsiderationsFixed
The report gives no description here.
WarningEvent inconsistenciesFixed
The report gives no description here.
WarningFalse commentsFixed
The report gives no description here.
Show 10 more
WarningFixed withdrawal credentials in CSVerifierFixed
The report gives no description here.
InfoHashConsensus should inherit from IConsensusContractFixed
The report gives no description here.
WarningInconsistent _onlyRecoverer function implementationFixed
The report gives no description here.
InfoInconsistent higher bits clearing in QueueLibFixed
The report gives no description here.
InfoInconsistent modifiers orderFixed
The report gives no description here.
InfoIncorrect documentation & typosFixed
The report gives no description here.
InfoIncorrect NatSpec formatFixed
The report gives no description here.
WarningInsufficient data validationFixed
The report gives no description here.
InfoInterfaces outside of dedicated folderFixed
The report gives no description here.
WarningInvalidExpectedOutAmount revertsFixed
The report gives no description here.
Show 10 more
WarningLimited ERC-2612 use- case with ERC-1271Fixed
The report gives no description here.
InformationalLock Not Released in Error ScenarioFixed
The report gives no description here.
InformationalLock Not Released in Error ScenarioFixed
The report gives no description here.
WarningMIN_POSSIBLE_BALANCE inadequate logicFixed
The report gives no description here.
InformationalMiscellaneous FindingsFixed
The report gives no description here.
InformationalMiscellaneous General CommentsFixed
The report gives no description here.
InformationalMiscellaneous General CommentsFixed
The report gives no description here.
WarningMissing curveId checkFixed
The report gives no description here.
InfoMissing eventFixed
The report gives no description here.
InfoMissing event on clearNodeOperatorPenaltyFixed
The report gives no description here.
Show 10 more
InformationalPast Report Data RetrievalFixed
The report gives no description here.
InfoQueueLib.clean return last index of cleared itemFixed
The report gives no description here.
InfoRedundant whenPaused checkFixed
The report gives no description here.
WarningSet delegate with zero voting powerFixed
The report gives no description here.
InfoState variable read multiple timesFixed
The report gives no description here.
WarningtargetLimitMode loose check in updateTargetValidatorsLimit sFixed
The report gives no description here.
WarningtargetLimitMode set to 0 not clearing targetLimitFixed
The report gives no description here.
InformationalTesting Findings And SuggestionsFixed
The report gives no description here.
Infotype GIndex should have pow() function availableFixed
The report gives no description here.
InfoTyposFixed
The report gives no description here.
Show 10 more
InfoTyposFixed
The report gives no description here.
InfoTypos and documentationFixed
The report gives no description here.
InfoUncached .length in for loopFixed
The report gives no description here.
WarningUnchecked blocksFixed
The report gives no description here.
InfoUnused codeFixed
The report gives no description here.
InfoUnused codeFixed
The report gives no description here.
InfoUnused functionFixed
The report gives no description here.
WarningUnused function parametersFixed
The report gives no description here.
WarningUse of a deprecated functionFixed
The report gives no description here.
WarningVersioned contracts can be initialized to zero versionFixed
The report gives no description here.
Contracts
No deployed address is recorded for these audits.
The reports name a repository or files. Open a report to see its scope.
Show this on your site
Is this your project? Show this record on your own website. The label states what the record holds, links to this page and updates by itself. It is free and needs no sign-in.
Content
Automatic: the three strongest facts of this project’s own record (its last audit and two more), highlighted. They update with the record. Picking a fact turns Automatic off.
Style
Format
<head><script src="https://widget.trustblock.run/project-widget.min.js" defer></script></head><body><divdata-tb-project-widgetdata-tb-project-slug="lido"></div></body>
Paste the code where the label should appear. It uses no API credit and updates by itself.
Something wrong on this page? A missing report, a wrong date, a finding that was fixed since. Tell us and we check it against its source.
Tell us