The Lido Finance liquid staking protocol team has assured users that assets in LDO and stETH tokens remain secure despite the presence of a vulnerability in the smart contract.
See more
This behaviour is expected and conforms to the ERC20 token standard (see tweet below). Both LDO and stETH (and Lido governance) remain safe.
Lido token integration guides will be updated with LDO specifics to make this more visible shortly.
— Lido (@LidoFinance) September 10, 2023
The developers have not confirmed any exploits through the bug, which was brought to the attention of SlowMist experts.
The cybersecurity firm said there was an “operational issue” in the LDO contract, which attackers have recently used to attack exchanges using “fake deposits.”
The vulnerability allows the transfer of tokens in quantities exceeding the actual assets of the user. In this case, the LDO contract does not trigger a normal transaction rollback, but simply returns “false” as a result. Experts indicated that the code differs from the ERC-20 standard.
Lido denied their claim. The developers noted that the “transfer” and “transferFrom” functions are necessary to determine the status of the transaction and are recommended for cancellation only in exceptional cases. However, the rules explicitly require the caller to check the returned status, they added.
See more
ERC20 token standard: https://t.co/YlrS1ZN6Fd
1) Both transfer and transferFrom are required to return transfer status and are only recommended to revert a tx in exceptional cases.
2) The standard says that a caller is obliged to check the return status (see ‘Token methods’). pic.twitter.com/6KTcIyxo2F
— Lido (@LidoFinance) September 10, 2023
The DeFi project team intends to update the Lido token integration guide, taking into account the features of LDO.
SlowMist noted that there are many tokens on the market that differ from ERC-20 requirements. Therefore, experts recommended not relying only on the success or failure of transactions, but also on the actual values returned by the contract. They emphasized the importance of a deep understanding of the code, extensive testing before integration, and regular cybersecurity audits.
At the time of writing, the total value of funds locked in the protocol at Lido is ~$14 billion, according to DeFi Call.
Recall that in July the figure exceeded $15 billion, and the team noted “impressive platform growth and market demand.”
Subscribe to ForkLog on social networks
Found an error in the text? Select it and press CTRL+ENTER
ForkLog newsletters: keep your finger on the pulse of the Bitcoin industry!
2023-09-11 09:30:05
#Lido #Finance #confirm #exploit #LDO #tokens #ForkLog
