Lido (stETH)

Effective control: sovereign. No issuer or chain operator can freeze or block this position.

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

The largest Ethereum liquid staking protocol, $17.85B on Ethereum at the 2026-08-14 review (DefiLlama), held as the uncorrelated ETH leg: staking is how the client’s ETH pays rent. The position is denominated in ETH; the dollar value falls in a drawdown, and the client hears that first. stETH rebases daily on a report from a 9-member oracle committee with a 5-of-9 quorum; wstETH is the fixed-balance wrapper DeFi uses. Control has improved on two axes since the last review. Dual Governance, live 2025-07-15, puts an on-chain brake in front of every DAO decision: about four days by default, extendable to 45 days as stETH holders lock into escrow, and past 10% locked a rage-quit blocks execution until objectors have withdrawn their ETH. The withdrawal mechanism can no longer change over stakers’ heads without a fight stakers can win by leaving. Concentration is falling too. Lido’s share of staked ETH is roughly 23% (Datawallet, May 2026), down from the ~32% peak of late 2023 that fueled the 33% consensus-safety debate. The Curated Module still holds about 90% of stake across dozens of professional operators, now including seven Ethereum client teams; the permissionless bonded Community Staking Module holds about 8.5% across roughly 335 operators, and Simple DVT runs 323 operators in 57 Obol and SSV clusters. The largest single operator’s share could not be verified this pass; the kill criterion pins it to the quarterly VaNOM read. The record over five and a half years: no exploit of the staking contracts, no loss of principal from a protocol failure. Two slashings, RockLogic on 2023-04-13 (11 validators, about 13.77 ETH, covered by DAO vote) and Launchnodes on 2023-10-11 (20 validators, roughly $30k, reimbursed), together under 0.01% of stake. The May 2025 Chorus One key theft cost 1.46 ETH of gas and proved the oracle design: one stolen key could not forge a report, and the DAO rotated it within days. The exit is the withdrawal queue: 1:1 ETH, FIFO, normally 1 to 5 days per Lido’s docs. That queue, live since April 2023, is the floor under the price. The worst discount, about 6% sustained in June 2022 after Terra, came when no redemption existed; post-Shanghai deviations have run in basis points. DEX depth is thin by design now, about $15M in the main Curve pool, so the minLiquidityUsd floor reads against all venues plus the redemption door, not on-chain pools alone; it catches a broken redemption arbitrage, it does not size an instant sale. The 25% cap stands because the queue takes days, the Curated Module v2 migration of about $16.5B is still in progress, and a quarter of the sleeve is the most one provider’s contract and oracle stack should carry.

Kill criteria: the events that revoke this verdict
• stETH/ETH secondary market discount exceeding 2% for more than 48h, or any bunker mode activation
• Any single node operator above 2% of all staked ETH via Lido, or the combined Community Staking and Simple DVT share falling for two consecutive VaNOM quarters
• Withdrawal queue exceeding 30 days
• Any change to the withdrawal mechanism or to Dual Governance parameters reaching execution, or stETH accumulating in the Dual Governance escrow toward the rage-quit threshold
• Curated Module v2 consolidation (migrating ~$16.5B since 2026-07-27): any slashing or accounting anomaly during the migration is a hold-and-review event
• Lido share of staked ETH re-approaching 33% (currently ~23%)
• A second oracle committee member key compromise, or any oracle report the 5-of-9 quorum has to reject
• Lido V3 stVaults: any change that lets stVault losses reach core-pool stETH

The research file

The mechanism

stETH is a rebasing token: balances change daily when the protocol’s oracle report lands, reflecting staking rewards and penalties. wstETH is the non-rebasing wrapper, a fixed balance whose exchange rate against stETH rises instead; DeFi integrations and L2s mostly use wstETH. Deposited ETH is routed through the Staking Router to three modules, Curated, Community Staking, and Simple DVT, which assign it to node operators’ validators.

Withdrawal has been live since the April 2023 Shanghai/Capella upgrade. It is a two-step request-then-claim flow through the WithdrawalQueue contract: the request locks and later burns stETH and mints an unstETH NFT that is the claim on future ETH, and requests are served strictly FIFO per the withdrawal-queue contract docs. Docs say 1 to 5 days under normal conditions; requests under 1,000 stETH usually clear inside a day when the protocol buffer holds ETH, and 1,000 to 5,000 stETH takes about 2 days. Time scales with queue size, validator exit rate, and buffer balance.

Bunker mode is the emergency state that slows withdrawals when mass slashing or penalties would otherwise let early exits dump losses on remaining holders. No activation was found in production, though none could be positively ruled out either.

The rebase runs on the AccountingOracle: a 9-member committee with a 5-of-9 quorum, keys rotatable by DAO vote. A finalized report triggers the rebase, operator reward distribution, and withdrawal finalization. The oracle is therefore the daily trust point: what the committee reports is what stETH is worth.

Who controls it

LDO holders govern through Aragon on-chain votes: module and operator onboarding, fee parameters, contract upgrades, treasury. Core contracts are upgradeable; the LidoLocator address book sits behind an OssifiableProxy, and component addresses change by swapping the implementation. There is no timelock in the classic sense. The delay is now supplied by Dual Governance, activated 2025-07-15 after LIP-28 passed (proposed May 2025, on-chain by early July). Every DAO decision waits about four days before execution; stETH holders can extend the delay by locking stETH in an escrow, 5 extra days at 1% of stETH locked, scaling to 45 days at 10%, and past the top threshold can trigger rage-quit: the DAO decision cannot execute until objecting stakers have withdrawn their ETH. That is a structural stETH-holder veto over LDO governance, including over the withdrawal mechanism, per Lido’s Dual Governance overview.

Two narrower powers exist. GateSeals let a designated committee instantly pause specific sealable contracts, the withdrawal queue among them, for a limited duration; the right is single-use per GateSeal and expires on a set date. A Deposit Security Committee guards against deposit front-running.

Lido V3 stVaults launched on mainnet 2026-01-30: modular per-institution vaults that mint stETH against isolated stakes, the design StakeWise pioneered. It is not the product this sleeve holds and core-pool stETH is unchanged by it, but it is a live expansion of the contract surface, and the kill criterion on stVault losses reaching core-pool stETH exists for that reason.

The operator set

Three modules sit on the Staking Router. The Curated Module holds roughly 90% of Lido Core stake as of July 2026, spread across dozens of professional operators; the set grew from the original 37 to include, since 2026, seven Ethereum client teams onboarded as operators. The permissionless bonded Community Staking Module holds about 770,000 ETH across roughly 335 operators, about 8.5% of Lido TVL. Simple DVT runs 57 Obol and SSV clusters with 323 unique operators, targeted at about 4% of stake. Direction of travel is toward more operators, not fewer.

Client diversity is the quiet strength. VaNOM Q4 2025 reports balanced consensus- and execution-client distribution; individual curated operators run up to five execution clients (Geth, Nethermind, Besu, Reth, Ethrex) and six consensus clients (Nimbus, Prysm, Teku, Lighthouse, Lodestar, Grandine), and DVT setups powered 5,900 Curated Module validators from Q3 2025. The Prysm monoculture that produced the RockLogic slashing is exactly what this diversity guards against.

The category context: the Ethereum LST review selected Lido and Rocket Pool on realized validator distribution, and used the same criterion to reject StakeWise V3, whose Genesis vault held roughly 40 to 45% of stake with StakeWise Labs at 45.85% of its validators. Rocket Pool’s independent operator count still beats Lido’s; Lido beats everyone on professional-operator client diversity.

Concentration

Lido’s share of all staked ETH is roughly 23%: Datawallet reports 8,863,785 ETH, 22.7% of staked ETH, as of May 2026, down from the ~32% peak of late 2023. Total ETH staked was about 39.7M, roughly 32% of supply across more than 1.24M validators, at mid-June 2026. The 33% threshold matters because a third of stake is the consensus-safety line where a single coordinating entity can delay finality; Lido’s own 2022 governance vote on self-limiting rejected a cap, which critics still cite. The direction since 2023 is down.

One source conflict: a 2026 source says over 9.2M ETH and ~28%. The 22.7% Datawallet figure is better sourced and is the one this memo carries; the next review should read Dune directly.

TVL on Ethereum was $17.85B via api.llama.fi on 2026-08-14, consistent with the $17.9B in the StakeWise memo, against Rocket Pool’s $0.99B. Within Lido, concentration is falling structurally: CSM and Simple DVT push stake toward hundreds of smaller operators, against the ~90% still in the Curated Module.

The record

Lido launched December 2020, days after the Beacon Chain, and has been the largest DeFi protocol by TVL for most of its life. The Solana and Polygon arms were wound down; residual non-ETH TVL is negligible.

The June 2022 discount is the worst event on the record and it was not a protocol failure. After Terra’s collapse pushed ~616,000 stETH of sell flow into the Curve pool, and Celsius and Three Arrows dumped positions, stETH traded 5 to 6% under ETH, with Dune data cited in press showing about 8% at the worst tick. The two firms withdrew about $800M of Curve liquidity on a single day, May 12, and over $180M of stETH-collateralized loans were liquidated. Withdrawals did not yet exist; the discount was a secondary-market event, and it closed after Shanghai enabled redemption in April 2023.

Two slashings, both covered. RockLogic, 2023-04-13: 11 validators slashed via a Prysm bug that re-imported supposedly deleted keys, about 13.77 ETH of damage including downtime, made whole from the DAO cover fund by on-chain vote enacted 2023-06-30. Launchnodes, 2023-10-11: 20 validators slashed on an infrastructure and signer configuration error, roughly $30k, with Launchnodes pledging reimbursement and the DAO holding a 6,230 stETH insurance fund against it. Cumulative slashing losses are under 0.01% of stake.

The 2025-05-10 Chorus One incident tested the oracle design. A 2021-vintage hot-wallet key used for oracle voting was compromised; the attacker took 1.46 ETH of gas money. The 5-of-9 quorum meant one stolen key could not forge a report, and an emergency DAO vote rotated the key within days. Operational failure at one member, not a contract or oracle-design failure, per Chorus One’s statement.

No exploit of Lido’s staking contracts and no loss of user principal from a protocol failure in five and a half years. Docs list repeated audits by Sigma Prime, ChainSecurity, MixBytes, Certora, Statemind, Oxorio, Hexens, Ackee, OpenZeppelin, and Consensys Diligence across V1, V2 in 2023, Dual Governance in 2025, and V3 in 2026 with an Immunefi audit competition. The Immunefi bug bounty tops out at $2,000,000 against $17.85B; compare StakeWise’s $200k against $700M.

One operation is live now: on 2026-07-27 Lido began Curated Module v2, its largest operational migration, consolidating validators (about 29% fewer) onto higher-capacity 0x02 credentials and moving on the order of $16.5B of stake. In progress at this review, with nothing adverse reported.

The exit

Two doors. The primary is the withdrawal queue: 1:1 ETH, FIFO, normally 1 to 5 days, capped only by validator exit throughput. The secondary is selling stETH or wstETH on DEXes and CEXes instantly at market.

Secondary depth is far thinner than the 2021-22 era by design. The main Curve stETH/ETH pool holds about $15M (GeckoTerminal, read 2026-08-14), versus billions pre-Shanghai; third parties frame this as rational, since primary redemption exists and deep standing pools are no longer subsidized. No aggregate figure across all venues, Curve, Balancer, Uniswap, and CEX order books, was verified, and that aggregate is what the minLiquidityUsd floor actually needs. The floor therefore reads against all venues plus the redemption door, not on-chain pools alone: it catches a broken redemption arbitrage, it does not size an instant sale.

The worst historical discount, about 6% sustained and ~8% intraday in June 2022, happened before withdrawals existed. Since April 2023 redemption puts a hard arbitrage floor under the price, and post-Shanghai deviations have been measured in basis points. The 30-day queue kill criterion is roughly 6x to 30x normal processing; only a mass-exit event or bunker mode reaches it, which is why any bunker activation is reportable to clients even if resolved quickly.

Comparison and cap rationale

Compared with Rocket Pool, Lido has much greater primary protocol scale, a larger professional operator set, and a stETH-holder delay and exit right through Dual Governance; Rocket Pool has more permissionless operator distribution and less dependence on a curated module. Compared with direct solo staking, stETH removes validator operations and makes the position transferable, but adds upgradeable contracts, a 5-of-9 reporting quorum, LDO governance, and a shared withdrawal queue. Compared with StakeWise V3, Lido avoids selecting a single vault whose operator concentration drove that memo’s rejection. Those trade-offs support approval, but not an uncapped allocation: 25% limits one upgradeable contract, oracle and queue stack while the Curated Module remains dominant and its v2 migration is unfinished.

Open questions

The purported April 2021 Staking Facilities slashing, part of Lido lore, found no primary source this pass; it must be confirmed against the blog’s postmortem archive before being cited, and this memo does not cite it.

The largest single operator’s share of Lido stake could not be verified from a current primary source; the VaNOM dashboards publish per-operator numbers and the Q4 2025 report is the latest. The kill criterion pins this to a quarterly VaNOM read because a concentration criterion nobody measures is not a criterion.

Aggregate stETH secondary liquidity across all venues was not measured; only the ~$15M main Curve pool was verified. If the $50M floor meant on-chain DEX depth alone, the position would sit below its own floor today, which is why the floor is defined against all venues plus primary redemption. The next review should establish the measured aggregate.

Also open: the worst post-Shanghai stETH/ETH deviation (needs a Dune peg dashboard read; press only covers the 2022 event), the current Curated Module operator count after CM v2 and the client-team onboarding (needs the operator portal), and whether bunker mode has ever activated (assumed never, not positively confirmed). The CM v2 migration itself, roughly $16.5B in motion since 2026-07-27, must be confirmed complete and clean.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Lido withdrawal queue contract documentation · primary · accessed 2026-08-15
  Supports: FIFO withdrawal mechanism, unstETH claim NFT, withdrawal finalization
• Lido accounting oracle contract documentation · primary · accessed 2026-08-15
  Supports: AccountingOracle reports, HashConsensus dependency, rebase inputs
• Lido withdrawal timing analysis · primary · accessed 2026-08-15
  Supports: normal withdrawal timing, queue-size sensitivity, validator-exit dependency
• Lido Dual Governance 101 explainer · primary · accessed 2026-08-15
  Supports: Dual Governance timelock, 1% first seal, 10% rage-quit threshold
• Lido governance record: RockLogic slashing · primary · accessed 2026-08-15
  Supports: 11 slashed validators, 13.77 ETH estimated impact, cover-fund proposal
• Lido governance record: compromised Chorus One oracle rotation · primary · accessed 2026-08-15
  Supports: single oracle-key compromise, 5-of-9 quorum, emergency key rotation
• Lido operator portal · primary · accessed 2026-08-15
  Supports: node-operator roster, module and operator monitoring
• Lido bug bounty on Immunefi · primary · accessed 2026-08-15
  Supports: $2M maximum bounty, in-scope contracts, severity terms
• DefiLlama Lido protocol API · secondary · accessed 2026-08-14
  Supports: protocol TVL, chain-level TVL

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.

Live positions