delegatecall with user-controlled target

Lido's assessment for RD-F-012 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

No delegatecall with user-controlled target found in Lido.sol, VaultHub.sol, or StakingVault.sol source inspection. OssifiableProxy uses delegatecall only to admin-set implementation. Aragon AppProxyUpgradeable delegates to Aragon-governed implementation.

Sources #

URL
Lido.solhttps://github.com/lidofinance/core/blob/master/contracts/0.4.24/Lido.solretrieved 2026-04-28
URL
VaultHub.solhttps://github.com/lidofinance/core/blob/master/contracts/0.8.25/vaults/VaultHub.solretrieved 2026-04-28
URL
StakingVault.solhttps://github.com/lidofinance/core/blob/master/contracts/0.8.25/vaults/StakingVault.solretrieved 2026-04-28

Methodology #

Determine whether any contract uses `delegatecall` where the target address is or can be user-supplied without an on-chain allowlist.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol lido factor RD-F-012 score green collected_at 2026-04-28 13:58:42