[Security Bulletin] Batched Immunefi-reported Weakness Disclosure — March 2026 (funds not at risk)

[Raman_Siamionau]

@TheDZhon

The affected EasyTrack factory will be replaced with a hardened one in the upcoming Aragon omnibus vote. The fix will enforce the used flag check of getSigningKey — ensuring that only deposited keys can be referenced in exit request motions. An updated factory will be deployed once the fix is audited.

Actions done:

• The fix were done and audited by MixBytes: audits/MixBytes Lido Easy Track Security Audit Report 03-26.pdf at main · lidofinance/audits · GitHub
• Updated implementation has been deployed and verified:
  • CuratedSubmitExitRequestHashes: 0x4F716AD3Cc7A3A5cdA2359e5B2c84335c171dCde
  • SDVTSubmitExitRequestHashes: 0x58A59dDC6Aea9b1D5743D024E15DfA4badB56E37

Proposed items for the upcoming vote:

• Remove old CuratedSubmitExitRequestHashes factory 0x8aa34dAaF0fC263203A15Bcfa0Ed926D466e59F3 from Easy Track
• Remove old SDVTSubmitExitRequestHashes factory 0xB7668B5485d0f826B86a75b0115e088bB9ee03eE from Easy Track.
• Add new CuratedSubmitExitRequestHashes factory 0x4F716AD3Cc7A3A5cdA2359e5B2c84335c171dCde to Easy Track (permissions: vebo.submitExitRequestsHash 0x0De4Ea0184c2ad0BacA7183356Aea5B8d5Bf5c6eb1b19f57).
• Add new SDVTSubmitExitRequestHashes factory 0x58A59dDC6Aea9b1D5743D024E15DfA4badB56E37 to Easy Track (permissions: vebo.submitExitRequestsHash 0x0De4Ea0184c2ad0BacA7183356Aea5B8d5Bf5c6eb1b19f57).