# Dual Governance Security Upgrade Plan: RageQuit ETH Withdrawal Delay Fix **URL:** \ **Category:** General\ **Created:** [August 13, 2025, 6:46pm UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543 "2025-08-13T18:46:26Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![psirex](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/psirex/32/6344_2.png) [@psirex](https://research.lido.fi/u/psirex)\ **Post date:** [August 13, 2025, 6:46pm UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/1 "2025-08-13T18:46:26Z")
## TL;DR This post outlines the deployment plan for a fix addressing the [Dual Governance weakness reported through Immunefi](https://research.lido.fi/t/security-disclosure-dg-weakness-reported-through-immunefi-funds-not-at-risk/10393). The fix involves redeploying certain Dual Governance contracts, configuring them, and linking the existing `EmergencyProtectedTimelock` and Admin `Executor` contracts to a newly deployed `DualGovernance` instance. The fix was [audited](https://github.com/lidofinance/audits/blob/main/Certora%20Dual%20Governance%20v1.0.1%20Hotfix%20Review%20Report%2008-2025.pdf) by [Certora](https://www.certora.com) and is currently being reviewed by [Statemind](https://statemind.io), which will also verify the deployment and review the tooling contracts used during the voting phase. [A special Immunefi contest](https://immunefi.com/audit-competition/lido-bug-bounty-competition/information/) was conducted on the fixed version of the contracts, with no vulnerabilities identified during the process. ## Upgrade Components Due to the immutable structure of the Dual Governance contracts, the fix requires disconnecting the `EmergencyProtectedTimelock` from the current `DualGovernance` instance and connecting it to a newly deployed version with the fix applied. The `TiebreakerCoreCommittee`, along with its subcommittees, will also be updated, as it includes immutable reference to the `DualGovernance` contract. The composition of the committee and its subcommittees will remain unchanged, as stated in the [original post](https://research.lido.fi/t/lido-dual-governance-tiebreaker-committee/10047). The old `DualGovernance` instance will be reconfigured with a new [`ImmutableDualGovernanceConfigProvider`](https://etherscan.io/address/0xc934E90E76449F09f2369BB85DCEa056567A327a#code) to prevent entry into a vulnerable state and allow users to freely withdraw funds from the old `Escrow`. After the upgrade, the final Dual Governance setup will look as shown below: ![Blank diagram (22)](https://europe1.discourse-cdn.com/flex013/uploads/lido/original/2X/5/521d7802fa08669e9ffa7c700c8620a3fb4502bd.png) The full list of upgraded contracts is: - Contracts to disconnect: - Newly deployed contracts: During the upgrade the following tooling contracts will be used: - `DGUpgradeOmnibusMainnet` [0x67988077f29FbA661911d9567E05cc52C51ca1B0](https://etherscan.io/address/0x67988077f29FbA661911d9567E05cc52C51ca1B0#code) - contains the list of the vote items required to apply the Dual Governance fix. - `DGUpgradeStateVerifierMainnet` [0x487b764a2085ffd595D9141BAec0A766B7904786](https://etherscan.io/address/0x487b764a2085ffd595D9141BAec0A766B7904786#code) - called as the final step of the vote to confirm that the contracts have been configured correctly. The full list of contracts is also available in the [documentation](https://docs.lido.fi/deployed-contracts/#dual-governance). ## Vote Structure To apply the fix, the `DGUpgradeOmnibusMainnet` contract contains a single Aragon vote item that submits a Dual Governance proposal with the following actions: 1. Finalize the configuration of the **new** `DualGovernance` instance — which can only be performed by the Admin `Executor` — to match the current mainnet setup: - Set the tiebreaker activation timeout to 31536000 seconds (1 year). - Set the tiebreaker committee address to the newly deployed Tiebreaker Core Committee. - Add `WithdrawalQueue` and `ValidatorExitBusOracle` as sealable withdrawal blockers. - Register Aragon `Voting` as Proposer, assigning it to the current Admin `Executor`. - Set Aragon `Voting` as Proposals Canceller. - Set the Reseal Committee address to [`0xFFe21561251c49AdccFad065C94Fb4931dF49081`](https://etherscan.io/address/0xFFe21561251c49AdccFad065C94Fb4931dF49081) (Reseal Committee, used in the current setup). 2. Set the `Governance` address in the `EmergencyProtectedTimelock` to the newly deployed `DualGovernance` instance. 3. Replace the config provider in the old `DualGovernance` with the new `ImmutableDualGovernanceConfigProvider`, effectively “bricking” the old instance and ensuring it cannot enter a vulnerable state, even unintentionally. 4. Verify the resulting state of the new `DualGovernance` onchain using the `DGUpgradeStateVerifierMainnet` contract to ensure all steps were executed correctly. ## Notes The current `DualGovernance` and `Escrow` contract instances will be detached from the `EmergencyProtectedTimelock`, making user interaction with them highly unlikely, though not entirely impossible. To ensure the old `Escrow` cannot enter a vulnerable state, the outdated `DualGovernance` instance will be updated to use a new configuration provider contract. This configuration sets: - RageQuit support thresholds to their maximum values - 100% for the second seal and 99.(9)₁₆% for the first seal - making it virtually impossible for the old `DualGovernance` to enter the RageQuit state. - All other parameters are set to minimal values, allowing users to unlock their funds without a timelock if they were mistakenly locked in the old `Escrow` instance. ## Verification The contract fix has been [audited](https://github.com/lidofinance/audits/blob/main/Certora%20Dual%20Governance%20v1.0.1%20Hotfix%20Review%20Report%2008-2025.pdf) by [Certora](https://www.certora.com) and is currently under review by [Statemind](https://statemind.io). Statemind will also perform deployment verification and review the vote-related `DGUpgradeOmnibusMainnet` and `DGUpgradeStateVerifierMainnet` contracts. All reports will be published before the vote goes onchain. The upgrade was successfully completed and tested on the Hoodi testnet, with contract bytecode identical to that deployed on mainnet. ## Thanks Lido Contributors are thankful to the whitehat reporter and security partners — [Immunefi](https://immunefi.com), [Certora](https://www.certora.com), and [Statemind](https://statemind.io). Note to tokenholders: please stay tuned for the upgrade vote in the upcoming voting slot. ## Context links [Security disclosure post](https://research.lido.fi/t/security-disclosure-dg-weakness-reported-through-immunefi-funds-not-at-risk/10393) [New contract addresses](https://docs.lido.fi/deployed-contracts/#dual-governance) [Certora Audit report](https://github.com/lidofinance/audits/blob/main/Certora%20Dual%20Governance%20v1.0.1%20Hotfix%20Review%20Report%2008-2025.pdf) ---
**Author:** ![cp0x](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/cp0x/32/4886_2.png) [@cp0x](https://research.lido.fi/u/cp0x)\ **Post date:** [August 13, 2025, 7:07pm UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/2 "2025-08-13T19:07:59Z")
I’m glad that the bug was found quickly before anything terrible happened. ---
**Author:** ![oz\_project\_manager](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/oz_project_manager/32/6211_2.png) [@oz\_project\_manager](https://research.lido.fi/u/oz_project_manager)\ **Post date:** [August 19, 2025, 7:16pm UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/3 "2025-08-19T19:16:10Z")
The above issue has been reviewed by the OpenZeppelin security services team and below is a summary of our analysis. **Issue Summary** Previously, the `rageQuitExtensionPeriodStartedAt` timestamp could be repeatedly overwritten, allowing the Rage Quit extension period to be indefinitely extended. This could prevent withdrawals from being processed as intended, creating a denial-of-service condition for users attempting to exit. **Root Cause** - The `startRageQuitExtensionPeriod` function sets the `rageQuitExtensionPeriodStartedAt` timestamp to `now + delay`. - This timestamp is used in `checkEthWithdrawalsDelayPassed` to determine if withdrawals can proceed. - If `startRageQuitExtensionPeriod` could be called repeatedly, the timestamp could be pushed further into the future each time, blocking withdrawals indefinitely. **Impact** - Malicious or repeated calls to `startRageQuitExtensionPeriod` could continuously delay withdrawals for affected users. - This effectively locks funds until the extension period passes without further calls to the function. **Fix Implemented** - Added a guard to `startRageQuitExtensionPeriod` to revert if `rageQuitExtensionPeriodStartedAt` is already set (non-zero). - This ensures the timestamp can only be set once, preventing any overwriting or extension abuse. **Security Considerations** - The fix prevents timestamp manipulation after the initial setting, eliminating the possibility of indefinite extension. - Withdrawal logic remains intact, and users can exit as expected once the legitimate delay passes. **Status** The fix has been reviewed and confirmed to address the identified vulnerability. No further action is required from Lido at this time regarding the identified vulnerability. ---
**Author:** ![psirex](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/psirex/32/6344_2.png) [@psirex](https://research.lido.fi/u/psirex)\ **Post date:** [August 29, 2025, 11:00am UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/4 "2025-08-29T11:00:21Z")
The [Statemind](https://statemind.io/) team has successfully completed the audit and deployment verification of the `Escrow` fix, including the review of the `DGUpgradeOmnibusMainnet` and `DGUpgradeStateVerifierMainnet` contracts. The final report is available here: [Statemind Dual Governance Escrow Fix Review Report (Aug 2025)](https://github.com/lidofinance/audits/blob/main/Statemind%20Dual%20Governance%20Escrow%20Fix%20Review%20Report%2008-2025.pdf). The Aragon vote to apply the upgrade is scheduled for **September 3, 2025**. ---
**Author:** ![nikita.p](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/nikita.p/32/5751_2.png) [@nikita.p](https://research.lido.fi/u/nikita.p)\ **Post date:** [September 3, 2025, 3:40pm UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/5 "2025-09-03T15:40:00Z")
**The Voting Has Started** The [Vote #191](https://vote.lido.fi/vote/191), which fixes the Dual Governance RageQuit mechanism, has just begun and will be open for your “For” or “Against” input until the end of the main phase: **Sep 6, 14:01 UTC**. For instructions on how to verify the vote items, please follow [this guide](https://enchanted-direction-844.notion.site/How-to-check-the-Lido-DAO-on-chain-vote-191-263bf633d0c980038e72d819094c1cb8). ---
**Author:** ![nikita.p](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/nikita.p/32/5751_2.png) [@nikita.p](https://research.lido.fi/u/nikita.p)\ **Post date:** [September 9, 2025, 10:18am UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/6 "2025-09-09T10:18:31Z")
**[Vote #191](https://vote.lido.fi/vote/191) was successfully passed and enacted!** Voting statistics: - “No” — 2 (0.01%) - “Yes” — 51,379,450 (5.13%) The voting items are now submitted to the Dual Governance with [proposal #4](https://dg.lido.fi/proposals/4) (expected to be executed on Sep 12). ---
**Author:** ![nikita.p](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/nikita.p/32/5751_2.png) [@nikita.p](https://research.lido.fi/u/nikita.p)\ **Post date:** [September 12, 2025, 6:33pm UTC](https://research.lido.fi/t/dual-governance-security-upgrade-plan-ragequit-eth-withdrawal-delay-fix/10543/7 "2025-09-12T18:33:43Z")
**[Dual Governance Proposal #4](https://dg.lido.fi/proposals/4) has been successfully executed - the RageQuit mechanism fix is now fully enabled and in effect!**