Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.
Evaluating
Triaged by Immunefi
PoC Required
This Bug Bounty Competition Is Under Evaluation
Thank You to All Participating Security Researchers!
The audit competition has now concluded and is currently in the evaluation phase. During this period, all submitted reports are being carefully reviewed by the Immunefi triage team and the project team.
Rewards
Rewards by Threat Level
Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3
In addition to the regular Lido Bug Bounty Competition rewards per severity, this competition offers a **$100,000 bonus rewards pool **for valid, non-duplicate reports on the assets in scope on this program.
This $100,000 bonus pool will be distributed among researchers based on the severity of their valid, unique submissions, as determined at the end of the competition.
Bonus rewards are paid out in the following priority order:
- Critical vulnerabilities
- High vulnerabilities
- Medium vulnerabilities
- Low vulnerabilities
The pool is allocated top-down, meaning bonuses are paid to higher severity submissions first. If sufficient funds remain after paying critical submissions, bonuses will be issued to high severity findings, and so on.
If fewer vulnerabilities are found than the total size of the pool, the full pool will not be spent.
For example, if only a single valid Critical is found, the bonus paid will be $50,000, and the remaining $50,000 will go unused.
Bonus amounts for each unique, valid report are:
- Critical: $50,000
- High: $10,000
- Medium: $2,000
- Low: $1,000
If the number of valid submissions in a given severity exceeds the available bonus pool for that severity category, then the funds will be evenly split among all eligible submissions in that category. For example, if 4 criticals are found, each critical severity report will be rewarded $25,000.
*Note:
- The bonus rewards pool is limited to $100,000.
- If the bonus rewards pool is exhausted, reports will still be rewarded under the regular Bug Bounty Program reward terms.
- Bug reports will be paid after the Bug Bounty Competition ends and rewards are calculated. 4.** Insights are out of scope** for this Bug Bounty Competition.
- Any reports on Lido assets that are NOT in scope for this Bug Bounty Competition should be submitted to Lido Bug Bounty Program.
- Duplicate submissions of bugs are not valid.
- Rewards are denominated in USD and distributed in USDC on Ethereum.
- Reports submitted via the regular Bug Bounty Program page will not be eligible for bonus rewards.
- If the same bug is submitted separately to both the Bug Bounty Program and the Bug Bounty Competition, the report will be eligible for rewards only under the program where it was submitted first. For example:
- If Security Researcher A submits a valid bug to the Bug Bounty Program, and Security Researcher B submits the same bug to the Bug Bounty Competition, then only Security Researcher A is eligible, under Bug Bounty Program terms.
- If the reverse happens, only Security Researcher B qualifies, under Bug Bounty Competition terms.
Repeatable Attack Limitations If the smart contract where the vulnerability exists can be upgraded or paused, only the initial attack will be considered for a reward. The amount of funds at risk will be calculated with the impact of the first attack being at 100% and then a reduction of 25% from the amount of the first attack for every [300 blocks] the attack needs for subsequent attacks from the first attack, rounded down
Program Overview
Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.
Dual Governance (DG) is a governance subsystem positioned between the Lido DAO (represented by various voting systems) and the protocol contracts it manages. It gives stakers a say by allowing them to block DAO decisions and providing a negotiation device between stakers and the DAO. Another way of looking at Dual Governance is that it implements:
- A dynamic user-extensible timelock on DAO decisions
- A rage quit mechanism for stakers taking into account the specifics of how Ethereum withdrawals work.
For more information about Lido, please visit https://lido.fi/
Lido provides rewards in USDC on Ethereum.
Audits
Known Issues
KYC not required
No KYC information is required for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 3: Approval Required
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules
Feasibility Limitations
The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.
Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.