> ## Content Index
> Fetch the complete content index at: https://blog.lido.fi/llms.txt
> Use this file to discover other available public pages before exploring further.

# Lido UI Potential Malicious Code Injection - Bug Bounty Report
- URL: https://blog.lido.fi/lido-ui-potential-malicious-code-injection-bug-bounty-report/
- Published: 2022-03-01T15:49:00.000Z
- Updated: 2026-05-05T21:50:52.000Z
- Description: On 21.02.2022 Lido has received Immunefi report from the United Global Whitehat Security Team on a vulnerability affecting the number Lido UIs
- Author: Lido
- Tags: Post Mortem, #Import 2024-09-02 13:00

On 21.02.2022 Lido has received [Immunefi](https://immunefi.com/?ref=blog.lido.fi) report from the [United Global Whitehat Security Team](https://ugwst.com/?ref=blog.lido.fi) on a vulnerability affecting a number Lido UIs, including landing page [lido.fi](http://lido.fi/?ref=blog.lido.fi), Ethereum & Terra staking widgets [stake.lido.fi](http://stake.lido.fi/?ref=blog.lido.fi) & [terra.lido.fi](http://terra.lido.fi/?ref=blog.lido.fi), Easy Track UI [easytrack.lido.fi](http://easytrack.lido.fi/?ref=blog.lido.fi) and two informational pages [lego.lido.fi](http://lego.lido.fi/?ref=blog.lido.fi) & [careers.lido.fi](http://careers.lido.fi/?ref=blog.lido.fi). The vulnerability consisted in the way the nextjs’ 'image' module handles particular missing file edge-case, allowing for malicious code injection on [lido.fi](http://lido.fi/?ref=blog.lido.fi), [stake.lido.fi](http://stake.lido.fi/?ref=blog.lido.fi), [terra.lido.fi](http://terra.lido.fi/?ref=blog.lido.fi) & [easytrack.lido.fi](http://easytrack.lido.fi/?ref=blog.lido.fi) and open redirect from [lego.lido.fi](http://lego.lido.fi/?ref=blog.lido.fi) & [careers.lido.fi](http://careers.lido.fi/?ref=blog.lido.fi). 

**The vulnerability has been patched for all reported domains in 5.25 hours after receiving the report, and based on url access logs no user have been affected.**

During the investigation, we discovered that the endpoints would reflect whatever was supplied in the url parameter for the nextjs image component endpoint. So,if we browse to https://lido.fi/next/image?url=/testing/&w=256&q=7, the phrase testing will appear in the HTTP response. The image endpoint was vulnerable to MIME sniffing, according to the researcher, since it lacked a content-type header and X-Content-Type-Options: nosniff header. As a result, the researcher was able to create a proof-of-concept that executed javascript in context on lido domains using MIME sniffing techniques.

Malicious code injection potentially allowed attacker to change the page contents & hijack user input *on Lido-owned domain*. That makes the vulnerability of critical impact, as attacker could craft the specific link to, say, [stake.lido.fi](http://stake.lido.fi/?ref=blog.lido.fi), so the users following that link would be sending funds to attacker’s wallet instead of Lido staking contracts. Another high-impact attack vector example would be preparing a link adding “share your seed phrase” form to [lido.fi](http://lido.fi/?ref=blog.lido.fi) landing page.

Informational pages [lego.lido.fi](http://lego.lido.fi/?ref=blog.lido.fi) & [careers.lido.fi](http://careers.lido.fi/?ref=blog.lido.fi) weren’t vulnerable to malicious code injection, but allowed for open redirect: user following a specifically formatted link to lido to [lego.lido.fi](http://lego.lido.fi/?ref=blog.lido.fi) or [careers.lido.fi](http://careers.lido.fi/?ref=blog.lido.fi) could have been redirected to another web domain, allowing for making legit-looking phishing links, but not pages. Note that in this case the domain would be different from the Lido-owned one, decreasing the potential impact.

With the phishing being pervasive issue for web3 projects, such vulnerability could have significant impact. We’re very grateful to the [United Global Whitehat Security Team](https://ugwst.com/?ref=blog.lido.fi) for the report and all the effort went into preparation & checks, as well as to [Immunefi](https://immunefi.com/?ref=blog.lido.fi) for facilitating the communication. Two bounties for the vulnerabilities have been payed out, one for critical and one for low tiers on malicious code injection and open redirect respectively.

Stay safe out there!