Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.
Live
Triaged by Immunefi
PoC Required
This Bug Bounty Competition Is Live!
$2,000,000 USD in Max Bounty + $200,000 Bonus Rewards Pool
available for finding bugs on the Lido V3 codebase.
In addition to the regular Lido Bug Bounty Program, this competition offers a $200,000 bonus rewards pool for valid, non-duplicate reports on the assets in scope. This $200,000 bonus pool will be distributed among researchers based on the severity of their valid, unique submissions, as determined at the end of the competition.
-
Rewards are denominated in USD and distributed in USDC on Ethereum.
-
KYC is not required.
-
Proof of Concept (PoC) Requirements: A PoC, demonstrating the bug's impact, is required for this program and has to comply with the Immunefi PoC Guidelines and Rules.
-
Insights are out of scope for this Bug Bounty Competition.
-
Duplicate submissions of bugs are not valid.
For more information about Lido V3, please visit https://v3.lido.fi/
What is a Bug Bounty Competition?
A Bug Bounty Competition is a unique blend between a traditional bug bounty program and an audit competition, offering the best of both worlds.
Let’s break it down: In the case of Lido’s V3, security researchers are invited to hunt for vulnerabilities in specific assets. Just like a regular Bug Bounty Program (BBP), valid submissions are eligible for core BBP rewards. But here’s the exciting part, there’s also a bonus reward pool of $200,000 up for grabs, on top of the usual BBP payouts. This bonus is only available during the limited competition period.
Rewards
Rewards by Threat Level
Mainnet assets:
Reward amount is 10% of the funds directly affected up to a maximum of:
$2,000,000Minimum reward to discourage security researchers from withholding a bug report:
$50,000Rewards are distributed according to the impact of the vulnerability based on the Immunefi Vulnerability Severity Classification System V2.3
In addition to the regular Lido Bug Bounty Competition rewards per severity, this competition offers a $200,000 bonus rewards pool for valid, non-duplicate reports on the assets in scope on this program.
This $200,000 bonus pool will be distributed among researchers based on the severity of their valid, unique submissions, as determined at the end of the competition.
Bonus rewards are paid out in the following priority order:
- Critical vulnerabilities
- High vulnerabilities
- Medium vulnerabilities
The pool is allocated top-down, meaning bonuses are paid to higher severity submissions first. If sufficient funds remain after paying critical submissions, bonuses will be issued to high severity findings, and so on.
If fewer vulnerabilities are found than the total size of the pool, the full pool will not be spent.
For example, if only a single valid Critical is found, the bonus paid will be $75,000, and the remaining $125,000 will go unused.
Bonus amounts for each unique, valid report are:
- Critical: $75,000
- High: $20,000
- Medium: $5,000
If the number of valid submissions in a given severity exceeds the available bonus pool for that severity category, then the funds will be evenly split among all eligible submissions in that category. For example, if 4 criticals are found, each critical severity report will be rewarded $50,000.
*Note:
- The bonus rewards pool is limited to $200,000.
- If the bonus rewards pool is exhausted, reports will still be rewarded under the regular Bug Bounty Program reward terms.
- Bug reports will be paid after the Bug Bounty Competition ends and rewards are calculated. 4.** Insights are out of scope** for this Bug Bounty Competition.
- Any reports on Lido assets that are NOT in scope for this Bug Bounty Competition should be submitted to Lido Bug Bounty Program.
- Duplicate submissions of bugs are not valid.
- Rewards are denominated in USD and distributed in USDC on Ethereum.
- Reports submitted via the regular Bug Bounty Program page will not be eligible for bonus rewards.
- If the same bug is submitted separately to both the Bug Bounty Program and the Bug Bounty Competition, the report will be eligible for rewards only under the program where it was submitted first. For example:
- If Security Researcher A submits a valid bug to the Bug Bounty Program, and Security Researcher B submits the same bug to the Bug Bounty Competition, then only Security Researcher A is eligible, under Bug Bounty Program terms.
- If the reverse happens, only Security Researcher B qualifies, under Bug Bounty Competition terms.
Impacts Clarifications
Critical
Loss of user funds:
- When a minimum of 2,000,000 USD of assets is at risk
- Reward: Minimum 100,000 USD, Maximum 2,000,000 USD
Loss of non-user funds (e.g., treasury):
- When a minimum of 1,000,000 USD of assets is at risk
- Reward: Minimum 50,000 USD, Maximum 1,000,000 USD
High
- When a minimum of 250,000 USD of assets is at risk
- Reward: Minimum 10,000 USD, Maximum 250,000 USD
Medium
- When a minimum of 50,000 USD of assets is at risk
- Reward: Minimum 1,000 USD, Maximum 50,000 USD
Impact Estimation
Impact estimation must correspond to the first phase of Lido V3 launch: https://research.lido.fi/t/lido-v3-design-implementation-proposal/10665#p-22926-rollout-plan-9
i.e.,
- Lido Core works as of now on mainnet
- stVaults global minting cap is 3% of TVL
- permissionned node operators
- each node operator has 50k mintable
- emergency msigs attached according to the post
Repeatable Attack Limitations
- If the smart contract where the vulnerability exists can be paused, only the initial attack window of 1-hour will be considered for a reward. This is because the project can mitigate the risk of further exploitation by pausing the component where the vulnerability exists.
- If the smart contract where the vulnerability exists can only be upgraded, only the initial attack window of 5-days for Critical issues and 9 days for other issues will be considered for a reward. This is because the project can mitigate the risk of further exploitation by upgrading the component where the vulnerability exists.
Program Overview
Lido is a liquid staking solution for Ethereum backed by industry-leading staking providers. Lido lets users stake their ETH - without locking assets or maintaining infrastructure - whilst participating in on-chain activities, e.g. lending.
Lido V3 represents a fundamental expansion of the Lido staking protocol through the introduction of Staking Vaults (stVaults) – isolated vault contracts that enable specialized staking arrangements between stakers and node operators. stVaults allow stETH to be minted not only from the main Lido pool but also from ETH held in these external contracts. All stVaults are coordinated and monitored by a central VaultHub contract that ensures proper collateralization and operational health.
The upgrade implements EIP-7002 support for triggerable withdrawals for stVaults, enabling more flexible exit mechanisms for staked ETH. To handle the increased complexity of managing multiple isolated vaults, the oracle system has been significantly enhanced with a "Lazy Oracle" design that reports vault-specific data and processes updates asynchronously rather than requiring synchronous updates for all vaults simultaneously, improving scalability and reducing on-chain overhead.
New Node Operator Predeposit Guarantee mechanism addresses deposit frontrunning vulnerabilities by requiring node operators to pre-commit their deposit data on-chain before actual deposits occur. This system includes on-chain BLS signature verification to cryptographically validate the deposit credentials, ensuring that operators cannot substitute malicious validator keys at deposit time.
All new components – core protocol accounting upgrade, stVaults architecture, oracle enhancements, and predeposit guarantees are included within the competition scope.
Audits
Known Issues
KYC not required
No KYC information is required for payout processing.
Proof of Concept
Proof of concept is always required for all severities.
Responsible Publication
Category 3: Approval Required
Prohibited Activities
- Any testing on mainnet or public testnet deployed code; all testing should be done on local-forks of either public testnet or mainnet
- Any testing with pricing oracles or third-party smart contracts
- Attempting phishing or other social engineering attacks against our employees and/or customers
- Any testing with third-party systems and applications (e.g. browser extensions) as well as websites (e.g. SSO providers, advertising networks)
- Any denial of service attacks that are executed against project assets
- Automated testing of services that generates significant amounts of traffic
- Public disclosure of an unpatched vulnerability in an embargoed bounty
- Any other actions prohibited by the Immunefi Rules