# Post-mortem: NOR (Curated Module) / SDVT “Recovery-lever” weakness

**URL:** https://research.lido.fi/t/post-mortem-nor-curated-module-sdvt-recovery-lever-weakness/10282
**Category:** General
**Created:** [July 1, 2025, 1:22pm UTC](https://research.lido.fi/t/post-mortem-nor-curated-module-sdvt-recovery-lever-weakness/10282 "2025-07-01T13:22:17Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![TheDZhon](https://dub1.discourse-cdn.com/flex013/user_avatar/research.lido.fi/thedzhon/32/800_2.png) [@TheDZhon](https://research.lido.fi/u/TheDZhon)
#### Post date: [July 1, 2025, 1:22pm UTC](https://research.lido.fi/t/post-mortem-nor-curated-module-sdvt-recovery-lever-weakness/10282/1 "2025-07-01T13:22:17Z")

</div>

**Post-mortem: NOR (Curated Module) / SDVT “Recovery-lever” weakness**  
_Impact Severity: Low_

- **Impact**  
A legacy Aragon function (`transferToVault()`, a recoverability feature in Aragon app templates allowing a user to recover tokens from an Aragon-based app) could redirect undistributed node-operator rewards (the protocol-fee portion) from the _NodeOperatorsRegistry_ (Curated Module and _SDVT implementation)_ contracts to the DAO Agent. The potential transfer is reversible and only adds operational overhead to undo the altered fee distribution outcome; **staker funds and operator rewards were never at risk; the only possible impact could be delayed receipt of daily rewards by the latter.**

- **Fixes (both applied & audited)**

- **Acknowledgement**  
Lido contributors thank [**Dmitry Zakharov**](https://research.lido.fi/u/dzahar0v/summary) (CTO of MixBytes, engaged through the **GRAPPA** initiative), for his responsible disclosure of the weakness. In addition to this, a huge thanks to the **Composable Security** and **Statemind** teams for their rapid reviews, and [Lido Oracle committee](https://research.lido.fi/t/expansion-of-lidos-ethereum-oracle-set) for their collaborative effort promtply reviewing and deploying the fix.

- **Lessons learned**  
When inheriting from external frameworks such as Aragon, the on-chain development action checklist now includes:

- **Key dates**

* * *

The weakness is now fully neutralized with no user impact, and Lido contributors’ playbook for integrating third-party frameworks has been tightened accordingly.