Immunefi
Blog
Platform
Bug Bounty ProgramsPR ReviewsAuditsMonitoringAudit CompetitionsInvite OnlySafe HarborVaultsManaged TriageHelp Center
Security Researchers

Join Immunefi

Find bugs. Get paid.

Immunefi Profile PicHelp for WhitehatsAll StarsLearnLeaderboardImmunefi Top 10 BugsWhitehat AwardsWhitehat Hall of FameReport FindingsResponsible Publication
LoginExplore bountiesGet Protected
Back to Explore
Bug Bounty Comp | Lido: Dual Governance-logo

Bug Bounty Comp | Lido: Dual Governance

Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.

ETH

Evaluating

12d: 14h remaining
Maximum Bounty
$2,000,000
Bonus Rewards Pool
$100,000
Rewards Token
USDC
Start Date
29 July 2025
End Date
12 August 2025
Lines of Code
3,262

  • Triaged by Immunefi

  • PoC Required

InformationScopeResources

Codebase

Title
Dual Governance
Description
Codebase
Link

Documentation

Title
Dual Governance Resources
Description
Documentation and further resources
Link
Title
Dual Governance Specification
Description
Overview
Link
Title
Dual Governance Mechanism Design
Description
Mechanism Details
Link
Go to Audits & Known Issues

Proof of Concept (PoC) Requirements A PoC, demonstrating the bug's impact, is required for this program and has to comply with the Immunefi PoC Guidelines and Rules

Asset Accuracy Assurance

  • Bugs found on assets incorrectly listed in-scope will be considered valid and be rewarded.

Private Known Issues Rewards Policy

  • Private known issues, meaning known issues that were not publicly disclosed, are valid for a reward.

Primacy of Impact vs Primacy of Rules

  • Lido adheres to the Primacy of Rules, which means that the whole program is run strictly under the terms and conditions stated within this page.

KYC Requirement

  • No KYC is required for the Lido Bug Bounty Competition

Eligibility Criteria

  • Security researchers who wish to participate must adhere to the rules of engagement set forth in this program and cannot be:
    • On OFACs SDN list
    • Official contributor, both past or present
    • Employees and/or individuals closely associated with the project
    • Security auditors that directly or indirectly participated in the audit review

Responsible Publication

  • Whitehats may publish their bug reports after they have been fixed & paid, or closed as invalid, with the following exceptions:

    • Bug reports in mediation may not be published until mediation has concluded and the bug report is resolved.

  • Immunefi may publish bug reports submitted to this Bug Bounty Competition and a leaderboard of the participants and their earnings.

Proof of Concept (PoC) Requirements

Feasibility Limitations

  • The project may be receiving reports that are valid (the bug and attack vector are real) and cite assets and impacts that are in scope, but there may be obstacles or barriers to executing the attack in the real world. In other words, there is a question about how feasible the attack really is. Conversely, there may also be mitigation measures that projects can take to prevent the impact of the bug, which are not feasible or would require unconventional action and hence, should not be used as reasons for downgrading a bug's severity.

Therefore, Immunefi has developed a set of feasibility limitation standards which by default states what security researchers, as well as projects, can or cannot cite when reviewing a bug report.

Immunefi Standard Badge

  • By adhering to Immunefi’s best practice recommendations, Lido has satisfied the requirements for the Immunefi Standard Badge.