Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.
Live
Triaged by Immunefi
PoC Required
Select the category you'd like to explore
Assets in Scope
Impacts in Scope
Build Commands, Test Commands, and How to Run Them
https://github.com/lidofinance/core/blob/feat/vaults/CONTRIBUTING.md
Is this an upgrade of an existing system? If so, which? And what are the main differences?
Lido V3 represents a fundamental expansion of the Lido staking protocol through the introduction of Staking Vaults (stVaults) – isolated vault contracts that enable specialized staking arrangements between stakers and node operators. stVaults allow stETH to be minted not only from the main Lido pool but also from ETH held in these external contracts. All stVaults are coordinated and monitored by a central VaultHub contract that ensures proper collateralization and operational health.
The upgrade implements EIP-7002 support for triggerable withdrawals for stVaults, enabling more flexible exit mechanisms for staked ETH.
To handle the increased complexity of managing multiple isolated vaults, the oracle system has been significantly enhanced with a "Lazy Oracle" design that reports vault-specific data and processes updates asynchronously rather than requiring synchronous updates for all vaults simultaneously, improving scalability and reducing on-chain overhead.
New Node Operator Predeposit Guarantee mechanism addresses deposit frontrunning vulnerabilities by requiring node operators to pre-commit their deposit data on-chain before actual deposits occur. This system includes on-chain BLS signature verification to cryptographically validate the deposit credentials, ensuring that operators cannot substitute malicious validator keys at deposit time.
All new components – core protocol accounting upgrade, stVaults architecture, oracle enhancements, and predeposit guarantees are included within the competition scope.
What ERC20 / ERC721 / ERC777 / ERC1155 token standards are supported?
-
Hoodi tokens:
-
Mainnet tokens:
Which chains and/or networks will the code in scope be deployed to?
- Ethereum Hoodi Testnet (chainId: 560048)
- Ethereum Mainned (chainId: 1)
What are the most valuable educational resources already available? (Ie. Documentation, Explainer videos or articles, etc)
Lido’s codebase can be found at
- Smart contracts: https://github.com/lidofinance/core/releases/tag/v3.0.0-rc.4
- Oracle: https://github.com/lidofinance/lido-oracle/releases/tag/7.0.0-beta.3
Documentation and further resources can be found on:
- Lido V3 Hoodi Testnet contracts: https://docs.lido.fi/deployed-contracts/hoodi
- Lido V3 Whitepaper: https://hackmd.io/@lido/B1NuB15-gx
- Lido V3 Technical Design: https://hackmd.io/@lido/stVaults-design
- Lido V3 — Design & Implementation Proposal
- Risk Assessment Framework for stVaults
- Default risk assessment framework and fee parameters for stVaults
Permanent freezing of funds
Protocol insolvency
Any governance voting result manipulation
Direct theft of any user funds, whether at-rest or in-motion, other than unclaimed yield
Theft of tokenized staking yield
Permanent freezing of tokenized staking yield
Acquiring owner/admin rights or roles without contract’s owner/admin action
Missing access controls / unprotected internal interfaces
Economic/financial attacks
Reversible freezing of funds
Off-chain apps sensitive data extraction (e.g. Oracle private keys)
Theft or loss of funds from a treasury
Out of scope
Smart Contract specific
- Incorrect data supplied by third party oracles
- Not to exclude oracle manipulation/flash loan attacks
- Impacts requiring basic economic and governance attacks (e.g. 51% attack)
- Lack of liquidity impacts
- Impacts from Sybil attacks
- Impacts involving centralization risks
All categories
- Impacts requiring attacks that the reporter has already exploited themselves, leading to damage
- Impacts caused by attacks requiring access to leaked keys/credentials
- Impacts caused by attacks requiring access to privileged addresses (including, but not limited to: governance and strategist contracts) without additional modifications to the privileges attributed
- Impacts relying on attacks involving the depegging of an external stablecoin where the attacker does not directly cause the depegging due to a bug in code
- Mentions of secrets, access tokens, API keys, private keys, etc. in Github will be considered out of scope without proof that they are in-use in production
- Best practice recommendations
- Feature requests
- Impacts on test files and configuration files unless stated otherwise in the bug bounty program
- Impacts requiring phishing or other social engineering attacks against project's employees and/or customers