Composable Security

BACKGROUND

Please describe your company and position.

I am the Security Audit Facilitator of Lido

Describe what your company does in a single sentence.

The Lido Labs helps develop the Lido liquid staking protocol by facilitating contributors and other legal counterparts relations.

OPPORTUNITY / CHALLENGE

What specific goals or objectives did you hire Composable Security to accomplish?

• Confirm that partial or delayed updates do not break the system, and that cross-vault consistency is maintained.
• Validate that the updated oracle logic accurately calculates each vault fees, ensure no vault can bypass fees, and prevents double counting.
• Ensure that fees within each vault are accounted for correctly and routed to the Lido DAO treasury.
• Identify security issues and potential threats both for Lido and their users.

SOLUTION

How did you find Composable Security?

• Referral
• Web3 Conference

Why did you select Composable Security over others?

• Good value for cost
• Referred to me

How many teammates from Composable Security were assigned to this project?

2-5 Employees

Describe the scope of work in detail. Please include a summary of key deliverables.

Composable Security conducted a comprehensive security assessment of the off-chain components of the Lido V3 protocol upgrade. This included checking the entire codebase for bugs and vulnerabilities, modeling threats, assessing checks and balances, and examining the proposed upgrade process itself. The deliverables included the audit report (to be published shortly).

RESULTS & FEEDBACK

What were the measurable outcomes from the project that demonstrate progress or success?

The Composable Security team was very responsive, providing regular updates on the process, asking pertinent questions about the codebase, and holding weekly virtual meetings with the development team to keep Lido contributors informed.

Describe their project management. Did they deliver items on time? How did they respond to your needs?

As a small team, Composable Security did an excellent job managing the project. They delivered everything they've promised on time and went above and beyond to arrange the timeline, so Lido was always aware of the current status of the engagement.

What was your primary form of communication with Composable Security?

• Virtual Meeting
• Email or Messaging App

What did you find most impressive or unique about this company?

The Lido Audits Committee struggled for a long time to find a strong audit service provider for our off-chain needs (unlike many great on-chain code researchers), and Cmposable Security was the first team to show consistently good results assessing the protocol's vital off-chain components.

Are there any areas for improvement or something Composable Security could have done differently?

The only concern from our side is that Composable Security is an extremely tiny team, which will make scaling for them difficult, resulting in limited capacity/availability at times.