[Security Disclosure] 25/7/2026 Minor Underreporting of Total Protocol CL-side balances in Accounting Oracle Report

Lido contributors are investigating an issue related to today’s stETH rebase as reported by the protocol accounting oracle, resulting in a daily rebase APR of 2.04% instead of the expected 2.15%. This is not due to protocol penalties, and no funds are at risk, but due to a single in-flight validator deposit (32 ETH) being unaccounted for in the oracle report.

Contributors have double-checked the aggregate balance of Lido validators on Ethereum’s Consensus Layer at the time of the oracle report (and thereafter) and there is nothing that indicates any funds are at risk.

No user action is needed.

The team is currently investigating the root cause and, once a fix is live, the following rebase will be inclusive of the previously under-calculated balances.

A full update will follow once the root cause is confirmed.

It’s important to note that the protocol has automatic guard-rails which govern allowable values for the daily rebase. As the actual delta was within the allowable range (3.6% of TVL within a 36-day window), these automated stops did not trigger.

Had the delta been meaningfully larger, these guard-rails would have automatically halted the settlement of the accounting oracle report, ensuring that an oracle miscalculation would not be able to trigger liquidations on lending markets.

10 Likes

Today’s stETH rebase has completed as expected and includes the ETH missing from yesterday’s under-calculated rebase (with an extrapolated APR of 2.29%). An update has been made and audited to the protocol oracle which should improve report speed and aid in the investigation of similar issues should any occur in the future.

Contributors are still working through the root cause analysis, and more information will be shared on the forums and here once available.

No funds were at risk at any point. Signs currently point to an edge case related to the missed inclusion of a single validator with a pending deposit in yesterday’s report.

A full post-mortem will be published in the coming days.

1 Like