Wrapped liquid staked Ether 2.0 (wstETH) security report
wstETH on Base security review: Lido bridged token at 0xc1CBa3fCea344f92D9239c08C0568f6F2F0ee452, upgradeable proxy governed by Lido DAO, 2 Medium centralization findings, no Critical or High issues.
No Critical or High issues were found in wstETH on Base, but holders rely on Lido governance and its bridge. The token is upgradeable by the Lido DAO and its supply is controlled by an upgradeable bridge; both are Medium centralization risks.
Trust score: 79/100. Source verified: Yes. Chain: base. Contract: 0xc1cba3fcea344f92d9239c08c0568f6f2f0ee452.
This report was last modified on 2026-10-20 and contains 2 material findings.
medium finding: Upgradeable bridge controls minting and can burn any balance
Only the L2ERC20TokenBridge (0xac9D11cD4D7eF6e54F14643a393F68Ca014287AB) can mint or burn. bridgeBurn accepts an arbitrary account, and the rule that a withdrawal burns only the caller's own tokens is enforced in the bridge, which is itself upgradeable by Lido governance. A malicious or faulty bridge upgrade, or a compromise of Base's canonical messenger, could mint unbacked wstETH or burn holders' balances. This is the trust model of Lido's lock-and-mint design.
Evidence: [E03] https://github.com/lidofinance/lido-l2/blob/fea8d76fd6464f8bda435a90b065fdd123f80727/contracts/token/ERC20Bridged.sol#L13-L57: ERC20Bridged: immutable bridge (L15), initialize sets name/symbol only when empty (L33-L36), bridgeMint and bridgeBurn restricted by onlyBridge (L39-L54). Parents: ERC20Core (_transfer, _mint L131, _burn L143) and ERC20Metadata. [E05] https://github.com/lidofinance/lido-l2/blob/fea8d76fd6464f8bda435a90b065fdd123f80727/contracts/optimism/L2ERC20TokenBridge.sol#L43-L98: L2ERC20TokenBridge: withdraw/withdrawTo burn from msg.sender via _initiateWithdrawal (L43-L61, L91-L98); finalizeDeposit mints only when called through the cross-domain messenger from the L1 bridge (L64-L80). BridgingManager.sol defines DEPOSITS/WITHDRAWALS enabler/disabler roles (L21-L28). [E06] https://github.com/lidofinance/docs/blob/ab17e91ed089ca52851cee0d19d05c9f9d3c62e3/docs/token-guides/cross-chain-tokens-guide.md#L145-L197: Lido cross-chain tokens guide: L2 wstETH token must be upgradeable behind a proxy (R-3), bridge endpoints upgradeable (R-4), governance executor as admin (L173-L178, Base executor listed), and the warning that the governance representative can upgrade the bridge and token (L196-L197).
Recommendation: Accept as the bridge trust assumption. Integrators should treat wstETH on Base as carrying Lido bridge-governance and Base messenger risk in addition to Ethereum wstETH risk.
medium finding: Proxy admin can replace the token logic
wstETH on Base is an OssifiableProxy. While it is not ossified, the admin can upgrade the implementation (proxy__upgradeTo / proxy__upgradeToAndCall) in one call, which could change balances, transfer rules or mint authority for all holders. Lido docs state the admin is the Lido DAO acting through the Base Governance Bridge Executor 0x0E37599436974a25dDeEdF795C848d30Af46eaCF, which reduces but does not remove this risk; the admin and the executor delay were not verified on-chain in this review.
Evidence: [E01] https://github.com/lidofinance/docs/blob/ab17e91ed089ca52851cee0d19d05c9f9d3c62e3/docs/deployed-contracts/index.md: Lido official deployed-contracts page (docs repo commit ab17e91, 2026-10-15), Base section: WstETH ERC20Bridged 0xc1CBa3fCea344f92D9239c08C0568f6F2F0ee452 (proxy) and 0x69ce2505ce515c0203160450157366f927243309 (impl); L2ERC20TokenBridge 0xac9D11cD4D7eF6e54F14643a393F68Ca014287AB (proxy); Base Governance Bridge Executor 0x0E37599436974a25dDeEdF795C848d30Af46eaCF; L1ERC20TokenBridge 0x9de443AdC5A411E83F1878Ef24C3F52C61571e72 on Ethereum. [E04] https://github.com/lidofinance/lido-l2/blob/fea8d76fd6464f8bda435a90b065fdd123f80727/contracts/proxy/OssifiableProxy.sol#L43-L88: OssifiableProxy: proxy__ossify (L43), proxy__changeAdmin (L52), proxy__upgradeTo (L58), proxy__upgradeToAndCall (L68), onlyAdmin reverts once ossified (L78-L88). [E06] https://github.com/lidofinance/docs/blob/ab17e91ed089ca52851cee0d19d05c9f9d3c62e3/docs/token-guides/cross-chain-tokens-guide.md#L145-L197: Lido cross-chain tokens guide: L2 wstETH token must be upgradeable behind a proxy (R-3), bridge endpoints upgradeable (R-4), governance executor as admin (L173-L178, Base executor listed), and the warning that the governance representative can upgrade the bridge and token (L196-L197).
Recommendation: Holders should treat Lido DAO governance as trusted for this token. Radar reviewer: read proxy__getAdmin() and proxy__getIsOssified() on Base before approval and confirm the admin is the governance executor.