Lido Finance Simple Delegation allows LDO token holders to delegate their voting rights to another address and participate in on-chain voting on behalf of the delegated voter.
Lido Finance has contracted with Ackee Blockchain to conduct a security review of Lido Finance Simple Delegation for a total of 10 days from March 18, 2024 to March 28, 2024.
Lido Finance has also engaged Ackee Blockchain to conduct a revision review of the results of Revision 1.0 upon commit. e3cef8c. 3 out of 10 findings were fixed, and the remaining 7 findings were acknowledged by the team with explanations. Lido Finance added several new tests and improved the documentation of individual functions.
Revised Edition 2.0
Lido Finance has contracted with Ackee Blockchain to donate a total of 2 engineering days from June 27, 2024 to July 1, 2024 to conduct an incremental review of the Simple Delegation project.
Lido Finance engaged Ackee Blockchain to conduct a review of the findings from the previous revision. 50d9802. 3 out of 4 findings were fixed, and 1 information finding was acknowledged. Aside from the fixed findings, two minor changes were made to the codebase to improve readability and gas usage. New changes were also reviewed. For details of the updated codebase, see Revision 2.1.
methodology
We started the review using static analysis tools including Wake. We then delved deeper into the logic of the contract. We used the Wake test framework for testing and fuzzing.
To ensure the correctness of the system, complex and completely different fuzz tests were prepared. Fuzzing was performed on bytecode generated by Solidity compiler version 0.4.24 with the optimizer enabled.
During our review, we paid special attention to the following:
- Ensures that your code is not affected by bugs in older compiler versions.
- The voting logic is correct and is not affected by additional delegation logic.
- Verify that the system’s arithmetic is correct and that arithmetic operations do not cause overflow or underflow.
- Upgradeability is properly implemented and used.
- Detects possible reentrancy in your code.
- Ensure that access control is neither too lax nor too strict.
- I’m looking for general issues like data validation.
Revised Edition 2.0
The review started with the migration to Solidity 0.6.2, which is required to run the Wake static analysis detector. We then continued to update the fuzz tests prepared in the previous revision and performed an incremental manual review in parallel with the fuzzing.
During our review, we specifically looked at the following:
- Refactoring didn’t introduce any new ways to exploit the system.
- Code style and readability are maintained at a high level.
range
The scope includes implementation of Lido DAO voting via simple vote delegation. Audit was performed on commit. 08d43e3The scope is as follows:
Revised Edition 2.0
The audit was performed on the commit. 079dd88The scope is the Voting.sol file.
result
Here we present our research findings.
Critical severity
No serious problems were found.
High severity
No high severity issues were found.
Medium severity
No issues of medium severity were found.
Low severity
No low severity issues were found.
Warning Severity
W1: How to use solcOptimizer
W2: Delegation does not expire
W3: The initializer can be front-run.
W4: The initializer does not provide any verification of correctness. _token
W5: Declaration Shadowing
W6: Unused function parameter
W7: Older Solidity version
W8: Division rounding error
W9: Setting up non-voting delegates
W10: Inconsistent attemptVoteForMultiple checker
Information Severity
I1: Unused features
I2: Reserved words
I3: Cache array length
I4: Invalid NatSpec format
conclusion
Our review yielded 10 warnings. We are also concerned about the very concept of vote delegation. While vote delegation is a powerful tool for increasing voter turnout, it can also concentrate power in a few hands. Furthermore, this mechanism is potentially subject to abuse (see original report, Issue W2: Delegations do not expire). Given Lido’s significant impact on the Ethereum ecosystem, we encourage the team to consider other approaches to address voter apathy that are more conducive to decentralization.
Revised Edition 2.0
The static analysis yielded I1 results, and our review yielded four informative results: The voting delegation concept remains unchanged.
Ackee Blockchain recommends Lido Finance as follows:
- Consider using the latest Solidity version to take advantage of the latest optimizations and bug fixes.
- Consider other approaches that might be more conducive to decentralization to address voter apathy.
- Addresses all other reported issues.
Ackee Blockchain’s full Lido Finance audit report, which includes a more detailed explanation of all findings and recommendations, can be found here.
We are very pleased to acknowledge Lido Finance and look forward to working with them again in the future.