Unveiling Lido Lend: Security-First Lending

Proposals
1

Lido Lend: Security-First Lending

Lido Lend

Lido contributors are unveiling the development of ‘Lido Lend’, a new decentralized lending market, built on a modified fork of Morpho Blue, designed with a novel set of security-forward safeguards and utilities that benefit both lenders and borrowers.

Lido Lend is built for lenders who are long-term, passive holders of on-chain assets looking for rewards, without exposure to hidden risks. It is designed around isolated lending markets and proposed to be governed by the Lido DAO (pending acceptance via governance vote). Every market is scoped so that lenders have clarity around the rules of the market, access to reliable exits during full utilization or liquidity crunches, and deposit screening mechanisms which seek to guard lenders from bad collateral.

Lido Lend applies the same opinionated, security-first approach that made stETH the bedrock collateral of Ethereum DeFi, and draws on Lido contributors’ six years of building critical infrastructure with zero major security incidents.

Motivation

Over the past year, incidents across lending markets have created what Lido contributors see as an opportunity for an opinionated and hyper-resilient spin on lending, purpose-built for looping on one side and conservative lenders on the other.

The core principles shaping the Lido Lend approach are:

  • The system should offer protections that close major attack vectors, e.g. through screening and filtering of hacked funds, and through a more deliberate approach to asset selection and separation.
  • Lending should be safe and dependable, following a “set it and forget it” approach, with high liquidity and reliable exit paths across market conditions.
  • Markets should be focused on blue-chip assets, pairs should be price-correlated (e.g. stETH / ETH) to temper potential volatility.
  • Borrowing should follow clear and predictable rules, so even under stressful market conditions extended looping positions can be unwound.

Lido Lend is not designed as a general-purpose pooled lending solution, but rather as a hyper-secure solution for the specialized needs of professional borrowers and risk-averse lenders, intended to complement current market solutions.

Why Lido?

Lido Staking is one of the most battle-tested protocols on Ethereum, with more than $25B staked in the form of stETH, novel DeFi primitives across Lido Earn and stVaults, and zero major security incidents since inception. This is the outcome of a security, transparency, and trust model that extends to all products under the Lido banner. With six+ years building critical onchain Ethereum infrastructure, Lido contributors have a proven operational track record. It’s time to bring this confidence to decentralized lending markets.

Next Steps

Lido contributors will share details of the unique features that differentiate Lido Lend over the next few weeks, and publish the detailed technical specifications, market parameters, and audit reports in a separate post in this thread, ahead of the relevant governance votes for launch and acceptance of the protocol by the DAO.

Low-risk DeFi is what Lido builds best, and Lido Lend complements both the stETH flywheel as well as Lido Earn. The synergy between these products opens a new growth vector for the Lido ecosystem, giving onchain natives everywhere a broader path to earn rewards in a user-forward and security-first manner. Lido Lend is coming this quarter.

Feedback and questions are welcome in this thread.

28 Likes
2

Over the last two years, Lido has launched several products, including Lido Earn, stVaults, and Wisp, but so far it’s difficult to see a clear ROI from these initiatives.

What is the reasoning behind continuing to launch new products that compete with established protocols like Morpho and Aave, while previous product launches have yet to demonstrate returns?

At the same time, DAO spending remains extremely high relative to the value being created by new products, making meaningful profitability seem far out on the horizon. For LDO holders, this is particularly difficult to justify when the current buyback program contributes essentially zero direct value to tokenholders.

Wouldn’t it make more sense to focus on significantly reducing the DAO cost base, proving clear ROI on existing initiatives, and establishing a path to sustainable profitability before continuing to expand into new products?

7 Likes
4

I support Lido exploring different directions to expand its revenue streams. In particular, I believe Lido has a strong advantage in the lending sector. However, there are two points that need to be clarified:

  1. Lido needs to reduce its annual operating expenses, with a maximum of $30 million per year. This could be discussed in conjunction with the NEST proposal. Within the approved budget, Lido can experiment with different products and expand its business lines, making the overall protocol more competitive.

  2. Once the revenue generated by these new business lines is fully received by the Lido DAO, what proportion should be used to buy back and burn $LDO? Should it be 50%, or some other percentage? This needs to be clearly determined.

As long as these two conditions are met, the community should support Lido in exploring valuable and promising directions for the protocol.

4 Likes
5

Glad to see Lido exploring lending. I think lending is one of the most important primitives for making onchain capital markets work, and there’s a strong case for building more around stETH.

That said, I’m not convinced a modified Morpho Blue fork is the right approach, especially for a product positioning itself as security-first.

One of Morpho Blue’s strengths is its simple, immutable and extensively reviewed core. Once you start modifying it even by a few lines, you’re introducing new security assumptions. That doesn’t necessarily make it unsafe, but the original audits, formal verification and track record don’t automatically carry over. For lenders, it’s another set of contracts they need to evaluate and trust.

We’ve seen the challenges of running lending forks before. Rari Fuse and Cream Finance, both built on Compound-derived architectures, suffered major exploits of around $80m and $130m respectively. Rari’s exploit was particularly concerning because a previous security fix had failed to cover one of the vulnerable functions. I’m not suggesting being a fork was itself the cause, but these incidents show how much responsibility comes with maintaining your own lending implementation, even when starting from established code.

There’s also the ongoing maintenance burden. When vulnerabilities are discovered or security improvements are made upstream, they don’t automatically extend to a modified fork. Someone needs to assess whether the fork is affected and coordinate a response. Depending on the architecture, that could even mean migrating users to new contracts.

Lending is a business in itself. It needs constant attention to collateral, oracles, liquidity, liquidations and incident response. The recent rsETH and Resolv USR incidents are good reminders of this. Neither originated in the lending contracts they affected, yet the consequences spread into lending markets. In the Resolv case, Morpho’s Public Allocator continued supplying liquidity to an affected market even after the exploit had started. Having secure core contracts is only part of the job. Responding quickly when something goes wrong elsewhere is just as important.

We experienced the trust problem firsthand at Avon. We built a floating-rate lending market with an onchain order book and ERC-4626 strategies to improve interest rate discovery and liquidity allocation, and went through five security audits/reviews. Although we ultimately didn’t launch it, getting prospective users comfortable with an entirely new set of lending contracts was one of our biggest challenges. Lido obviously has a much stronger reputation and distribution, but I wouldn’t underestimate how cautious lenders are about taking on additional smart contract risk when established alternatives already exist.

I also have some reservations about the isolated market model for this particular use case. Liquidity is separated across markets, and if Lido follows Morpho’s vault model, that brings another layer of active management and curator discretion.

The promise of reliable exits during full utilization is particularly interesting. What would those exits actually look like? Would lenders receive their underlying assets, or retain a claim on an illiquid position? And where does the liquidity come from during periods of stress?

The proposed screening of hacked funds also sounds useful, but I’d be interested in understanding how it works in practice, particularly who determines which funds are flagged and what happens when that information is incorrect or unavailable.

There are other approaches worth considering. Coinbase built its lending and borrowing products on Morpho, while EtherFi Cash moved from its custom lending engine to a dedicated Aave V4 deployment. V4’s Hub-and-Spoke architecture also allows different types of lending markets with their own risk parameters and potentially access to shared liquidity. EtherFi’s deployment is isolated and it still manages its own risk and liquidity, but it no longer needs to maintain a bespoke lending core.

I’m not suggesting Lido should necessarily work with either of them. Both approaches have their limitations, and a purpose-built protocol may well be justified if the proposed safeguards genuinely require changes to the core contracts.

But Lido already has significant advantages in distribution, liquidity relationships and the stETH ecosystem. I’m not sure owning another lending codebase adds enough value to justify the additional security, operational and liquidity bootstrapping costs.

I know the detailed specifications and audits are still to come. I’d really like to understand which of the proposed safeguards cannot be built on existing lending infrastructure, and whether those benefits outweigh the additional costs and risks of maintaining an independent fork over the long term.

1 Like
6

Next up: mint stUSD (or lidoUSD) against wstETH collateral.

Money sink/proprietary yield for stUSD: stability pool/instant redemption insurance pool/or vanilla bad debt insurance

3 Likes
8

Hi @Izzy, thanks for sharing this! Would be great if in the detailed updates over the next weeks you can cover “why Lido Lend?” from a financial point of view. In particular:

  • what is the investment required to launch and maintain it
  • what is the expected return
  • what we need to believe for these two to materialise as expected

Morpho and Aave V4 are doing a pretty good job in DeFi lending so Lido will really need to provide a differentiated and profitable product for this to be worth it. So far, Lido has built the best DeFi Ethereum staking solution but it has not done so with the best ROI so would be good to see how new proposed product expansions consider that angle.

2 Likes
EIP-8363 Mitigation Plan
9

Great initiative and thanks to the contributors who put this together. I think this design has potential to unlock and serve institutional partners.

A growing share of ETH now sits with custodians, ETP issuers, fund managers and corporate treasuries, and most of it earns nothing beyond base staking yield because their mandates exclude permissionless lending venues. Aave Horizon showed what happens when that barrier is removed for RWAs: its permissioned markets passed $1bn in deposits within about six months of launch. stETH is already the most widely held liquid staking token, and Lido Lend’s correlated pairs, deposit screening and exit guarantees answer the first three objections an institution’s risk committee raises.

Further, institutions hold far more BTC than ETH, and almost none of it earns a yield. Even onchain, more than $9bn of wrapped BTC sits on Aave and Morpho alone at effectively 0%, posted as idle collateral or supplied into markets with no borrow demand. A venue that institutions trust to put that BTC to work safely would open a client base most of DeFi has never reached, especially as yields grow.

I’ve worked on regulated digital asset products in North America and Europe for several years and have seen demand from issuers, custodians and fund managers to integrate onchain lending into their offerings. I see an opportunity for Lido Lend to service this market, effectively B2B2C. Four questions in relation to this:

i.) Curation and access: Will market and vault creation be permissionless, as on Morpho Blue, or DAO-whitelisted? Can third-party curators run vaults on Lido Lend? And will the fork support allowlisted, KYC’d depositor vaults sitting on top of the public markets?

ii.) What is the screening mechanism: which data source, checked only at deposit or continuously, and what happens to a position flagged after entry? Will screening decisions be exposed onchain or via an attestable log? An institution has to evidence its own transaction-monitoring obligations, so it needs something it can point an auditor or regulator to, not only a protocol-level assurance.

iii.) Exits at full utilization: How are exits guaranteed mechanically during a liquidity crunch, and what are the worst-case timing assumptions? Funds with daily redemption obligations will size their allocations to that number.

iv.) Asset scope: Are BTC markets in scope, either correlated pairs across wrapped BTC and BTC liquid staking tokens or BTC collateral against stablecoins?

I’d be glad to act as a design partner to make sure this can serve institutional clients which I see as a big market prize. I can share a short requirements memo covering what they would need from market parameters, screening and reporting, ahead of the technical spec. Happy to take it to DMs with whoever is leading integrations.

2 Likes
11

Lido Lend Feature Highlight #1: Fallback Exits

Today we are excited to present the first of Lido Lend’s unique user features, dubbed Fallback Exits, a novel lending mechanism built to provide lenders with a secure and predictable liquidity exit path in times of turbulence.

Understanding Fallback Exits

In traditional lending markets, when loan asset liquidity dries up, lenders who want to withdraw are put in a position where they must wait for liquidity to return. This waiting can take days, or even weeks, before lenders regain access to a liquid position.

Fallback Exits are designed to address this need, by giving lenders an always available withdrawal path: when loan asset liquidity is insufficient, lenders can ‘Fallback Exit’ by using borrower collateral to supplement the withdrawal request.

Since Lido Lend consists of isolated markets and highly correlated assets (e.g. wETH <> wstETH, or USD <> Treasury RWAs), the option of exiting into borrower collateral (wholly or in part) provides a path to liquidity, even in extreme market turbulence.

Taking the ETH <> wstETH market as an example:

Assuming ETH liquidity is in short supply, in a traditional lending protocol, a lender would be stuck waiting for it to return; with Lido Lend, a lender can now utilize the Fallback Exit mechanism while attempting to withdraw which would allow for eligible borrower debt to be utilized to supplement any shortage in available ETH in order to meet the full withdrawal request. If Fallback Exit is utilized, the outstanding debt of relevant borrowers whose collateral is used for the Fallback Exit is also commensurately reduced. This represents a credible withdrawal path, even in adverse market conditions, into an asset that the lender is already (indirectly) exposed to via the lending market mechanism in a clear and understandable manner.

Which borrowers are impacted by Fallback Exits?

Subject to governance approval of proposed protocol specifications, borrower collateral in the case of a Fallback Exit would be taken from borrowers based on a highest-position-risk ordering: those with positions closest to the LLTV ratio would have their collateral utilized first, while borrowers with highly healthy positions are much less likely to be affected by Fallback Exits.

Full details will be available when the technical specification and market parameters are published in the next 2 weeks.

What’s Next?

Over the coming weeks, Lido Lend will progress through the required governance processes needed for general DAO acceptance of the protocol before mainnet launch. As a part of this, more features, technical specifications and audit reports will be made public.

10 Likes
12

Also I wanted to thank everyone for the comments and questions thus far, we’re a little bit heads down getting ready for the full proposal, but I will try to make sure to answer the questions that I can early next week!

7 Likes
13

It will be good to see a business plan for this product, including costs and projected payback. So far, previous developments have only shown losses

17

The technical specification is still ahead, and 0xmcg has already asked who may create a market and run a vault. There is a second half to that which the same document could settle.

On Morpho Blue there is no oracle at the protocol level. Every lending market is created with its own price feed, and that feed can never be changed afterwards, so the oracle choice belongs to whoever creates the market, once and permanently.

Will Lido Lend keep that property, and will the price feed for each launch market be named in the technical specification rather than settled at deployment?

1 Like
24

Interesting idea, but doesn’t seem likely for such a conservative and institutional player on the eth ecosystem…

1 Like
25

Seems like a novel approach, just wondering if it’s been modelled by any previous projects..

1 Like
32

These basically all launched within this year (Earn in March, stVaults was technically like December 25th but in “early access” mode with proper release in january, Wisp just a few months ago). So, none of these products have been launched on the order of two years as indicated by this comment. Most importantly, although it would be great to see super successful ROI on an order as short as less than a year, I honestly don’t think this is a reasonable expectation / benchmark for determining whether something has been successful or not, especially in these market conditions. I think that what one should be looking for here is: are these products that make sense given a broader belief & strategy that DeFi will see some sort of resurgence in the next few years, and are these efforts effective in allowing Lido DAO and the Lido Ecosystem to be better positioned to be a beneficiary of this growth?

What is the reasoning behind continuing to launch new products that compete with established protocols like Morpho and Aave, while previous product launches have yet to demonstrate returns?

In the case of Lido Lend I think it’s pretty clear: we see an opportunity here to establish a type of lending that is hyper-focused on putting security and lenders first, basically offering the best risk-adjusted yield on the market. Morpho and Aave are wildly successful each in their own rights, one as a generalized protocol for ownerless immutable lending markets, however chiefly dominated by curated vaults as a means of user interaction, and the other as a generalized lending protocol mostly focused around pooled / cross-margin collateral. Lido Lend is aiming for a smaller part of the market (at least initially): for the security-minded lenders who have retreated from DeFi and lending post Kelp/L0, and for the security-minded users of Ethereum who have yet to wade into lending because they don’t believe that the current options are sufficiently secure or resilient (from institutions to OG whales etc).

More importantly, if we believe that DeFi will grow in the next few years, creating product lines that allow for Lido to benefit from DeFi growth in the mainstay sectors (i.e. we started with staking, lending is a logical next step) makes a lot of sense. Often times new products / business lines take time to demonstrate positive returns – the cases of products being a year one runaway success in this sector (especially in the midst of a weak market) are very few and far between. The purpose is to build a framework and substrate to position Lido as an ecosystem of products that is robust to both a growing market (after all Lido DAO itself as well as the general ecosystem is “long” on users and value increasingly coming onchain in the next years), and you do this by making products that are positioned to grow as general onchain value and usage also grows. This is also why you see a lot of the larger players converging on general long-term strategy.

At the same time, DAO spending remains extremely high relative to the value being created by new products, making meaningful profitability seem far out on the horizon. For LDO holders, this is particularly difficult to justify when the current buyback program contributes essentially zero direct value to tokenholders.

I take issue with the presented assumption that DAO spending remains extremely high given how much costs have been reduced from both the ask for 2026 but also in terms of trajectory of actual costs from the beginning of the year to now (e.g. Staking is on track to spend meaningfully less than even the revised cost ask, which I think is something to be lauded, not derided).

re: buybacks, I don’t think this is the right place for this discussion (not only because there’s lots of other threads on this already, but most importantly because this discussion is unlikely to be directly related to Lido Lend or be constructive). I think these topics are worth discussing, but there’s already multiple venues for them, so I won’t engage on this directly here.

Wouldn’t it make more sense to focus on significantly reducing the DAO cost base,

IMO that’s exactly what has happened this year, and is clearly evident from e.g. comparison of budget ask at beginning of year vs current actuals and projected spend at EOY. Most importantly, the cost base for Staking has increasingly shrunk, with the cost savings being re-allocated into things like Lido Lend, which the DAO can ultimately choose to accept and maintain further or not (as a part of the upcoming proposal).

Costs basically already been drastically reduced this year, I don’t get this oft-repeated line that they haven’t been – are you looking at the quarterly financials that are shown during the tokenholder calls?

As stipulated above, I think these discussions belong in the relevant topics that already exist and will detract from constructive discussion on the specific matter at hand here which is Lido Lend.

2 Likes
33

Lido Lend Feature Highlight #2: Guardian Security Council

The next Lido Lend feature we’re excited to share is the ‘Guardian Security Council’ (GSC).

The GSC is a screening mechanism built to help protect Lido Lend markets, and especially lenders, from tainted or stolen assets, as well as other novel attack vectors.

Understanding the Guardian Security Council

In most DeFi lending markets, lending collateral can be deposited and borrowed against instantly, without health or provenance checks. This creates a situation where stolen, spoofed and tainted assets could be used to borrow legitimate assets, essentially allowing a malicious actor to use lent funds as exit liquidity. This creates a substantial attack vector for on-chain lending, which has historically led to extended periods of extreme market volatility, and often losses on users’ principal.

Lido Lend hardens lending infrastructure by introducing a screening mechanism for new collateral deposits, dubbed the Guardian Security Council, with one instance for each different lending market. Each Guardian Security Council is a collection of independent operators tasked with assessing new borrower inflows and originating accounts (who the collateral is supplied on behalf of) for any potential security implications. This occurs through the use of a “maturation window” for all new collateral, a time lag between deposit and when the collateral becomes active (able to be borrowed against) in the lending market, creating an opportunity to stop hacked funds before they harm users.

Guardian Security Councils check collateral provenance, including whether or not funds, or the originating address, are:

  • Compromised or contain funds from compromised sources;

  • Related to illicit funds or funding of illicit activities;

  • Attempting to exploit or abuse Lido Lend.

The GSC mechanism introduces light friction on the borrower side to drastically increase the long-term integrity and resilience of the system as a whole.

Guardian powers are deliberately limited. A ban blocks new borrowing by an account and stops pending collateral from maturing. It does not touch repayment, liquidation, settlement, or a debt-free withdrawal of collateral. Guardians cannot freeze or move assets, change market parameters, or unban accounts.

The purpose of this design is to keep stolen or sanctioned collateral from becoming borrowing capacity before there has been time to react, and funds remain controllable by the original owner at all times.

What’s Next?

The length of the screening period and the screening providers participating in the GSCs are subject to governance approval of the proposed protocol specifications. Full details will be shard in the next few days together with the technical specification and market parameters.

5 Likes
35

Hey folks!

A full Lido Lend proposal is on the way, but in the meantime, I’ll be walking the community through Lido Lend during the upcoming Lido Poolside community call next Thursday, October 29, at 2pm UTC.

We invite everyone to register and add to your calendar: luma.com/c6t2hftd

I’ll walk through the motivation, proposed approach, next steps, and answer questions from the community.

If you’re following this thread and have questions you’d like to raise live, definitely make sure to join!

3 Likes
36

This is a great post and lots of things to cover. I won’t be able to address everything in the detail it deserves unfortunately, but will have a crack at getting at the main points.

That said, I’m not convinced a modified Morpho Blue fork is the right approach, especially for a product positioning itself as security-first.
One of Morpho Blue’s strengths is its simple, immutable and extensively reviewed core. Once you start modifying it even by a few lines, you’re introducing new security assumptions. That doesn’t necessarily make it unsafe, but the original audits, formal verification and track record don’t automatically carry over. For lenders, it’s another set of contracts they need to evaluate and trust.

This is correct, however what’s important to keep in mind is that the changes that have been made still undergo the same rigorous security-first principles thinking that underpins all the work that Lido contributors do, as well as going through external audits and AI-assisted continuous audit and monitoring.

I’m not suggesting being a fork was itself the cause, but these incidents show how much responsibility comes with maintaining your own lending implementation, even when starting from established code.

Sure, but creating a brand new lending protocol whole-cloth would come with these considerations and more.

Neither originated in the lending contracts they affected, yet the consequences spread into lending markets. In the Resolv case, Morpho’s Public Allocator continued supplying liquidity to an affected market even after the exploit had started. Having secure core contracts is only part of the job. Responding quickly when something goes wrong elsewhere is just as important.

That’s exactly why we’ve proposed additional security mechanisms such as the Guardian Security Council, to directly address these kinds of risks.

I also have some reservations about the isolated market model for this particular use case. Liquidity is separated across markets, and if Lido follows Morpho’s vault model, that brings another layer of active management and curator discretion.

It’s true that isolation brings a host of liquidity challenges, at the same time, it’s very difficult to minimize risk in any kind of non-isolated model – so if we’re starting from a security-first paradigm, I think it makes sense to start from isolated markets first and then slowly branch out. While curated DeFi vaults like EarnETH and EarnUSD will most likely be early users of Lido Lend, and we’re discussing with a variety of different curators on how LL markets can be integrated or utilized by their vault offerings, we don’t anticipate “additional” curation duties will be needed here. I would imagine that users can either interact with the LL markets directly (mostly on the supply side) or via some sort of lightly curated or automated-based approach such as via Fluid/Gearbox/DeFi Saver type integrations where isolated markets means that less curation is actually needed and fully automated solutions for demand-side interaction can be spun up.

The promise of reliable exits during full utilization is particularly interesting. What would those exits actually look like? Would lenders receive their underlying assets, or retain a claim on an illiquid position? And where does the liquidity come from during periods of stress?

Check out the post on fallback exits here and stay tuned for full details in the coming days when we share the full technical proposal. TLDR, fallback exits work by using the borrower collateral in times of liquidity crunches to help lenders supplement any primary asset shortage when they make withdrawal requests.

There are other approaches worth considering. Coinbase built its lending and borrowing products on Morpho, while EtherFi Cash moved from its custom lending engine to a dedicated Aave V4 deployment. V4’s Hub-and-Spoke architecture also allows different types of lending markets with their own risk parameters and potentially access to shared liquidity. EtherFi’s deployment is isolated and it still manages its own risk and liquidity, but it no longer needs to maintain a bespoke lending core.

As Lido Lend evolves all options are open. I think the Aave V4 model is quite interesting, and once we start to consider a pooled lending model for other use cases (eg lending ETH/wsteth/other blue-chips to borrow stables), it makes sense to explore these options anew. This will introduce a potential challenge and complexity of needing to maintain multiple codebases, which is indeed not ideal, but it’s something that we feel we can still work.

2 Likes
37

We will require a bit more time to have well-rounded and concrete answers to these questions, and hope to share those as a part of the GOOSE and EGG proposals for next year (so hopefully around late November).

1 Like
41

If others can succeed, then what is the reason LDO can succeed? Why would customers choose LDO?

Others do institutional staking, and LDO went and did it too — but it did not capture any institutional staking share. I don’t think this is a timing issue. The real questions are: which customers can LDO target? And what core advantage does it have in doing this?

Institutions have their own brand advantages. Ethfi used innovation to gain more publicity and brand promotion. LDO should pay attention to its own brand building.

1 Like