Lido approves SEAL Safe Harbor exploit-response framework

What happened

LDO holders approved adopting the SEAL Whitehat Safe Harbor framework for Lido on Ethereum, including recovery, bounty, scope-management, and incident-contact terms.

What changed

Governance approved a civil safe-harbor path for whitehats responding to active exploits, a 10% bounty capped at $2 million, return of recovered assets to the Aragon Voting contract, and temporary 4-of-5 committee authority over the agreement’s scoped-account list pending audits and transfer to DAO control.

What did not change

The vote did not itself demonstrate on-chain registration, transfer agreement ownership to Aragon Voting, dissolve the temporary committee, allocate a bounty, or establish that any exploit or recovery had occurred.

Confirmed

• The Snapshot vote closed on 2025-12-19 with approximately 56.73 million LDO Approve votes and zero Reject votes.
• Approved bounty terms were 10% of recovered assets, subject to a $2 million individual and aggregate cap for an incident.
• Whitehats must return recovered assets; any bounty payment requires a separate Lido DAO governance vote.
• The designated recovery address was the Aragon Voting contract on Ethereum.
• A named 4-of-5 committee was approved to manage scoped accounts temporarily; the proposal states that the committee would not custody funds.

Still open

• Whether the agreement was subsequently registered in the Safe Harbor Registry.
• Whether the Safe Harbor contract audits were completed and agreement ownership transferred to Aragon Voting.
• Whether the temporary committee was dissolved and whether its scope changed before dissolution.
• Whether every contract listed in the initial protected-asset scope was operative and under the represented ownership at approval time.

What it means for an advisor

• Review the Lido control map to record the new exploit-response framework, recovery destination, bounty economics, and temporary scope-management authority.
• Verify the later on-chain registration and ownership state before treating the approved framework as operational.
• Do not infer that Safe Harbor adoption prevents exploits, guarantees recovery, or changes the existing stETH withdrawal and loss-allocation mechanics.