Lido pauses the ZKsync wstETH bridge after discovering a potential security weakness

Lido Finance has paused new deposits into its ZKsync Era wstETH bridge after discovering a potential vulnerability in the bridge’s endpoint smart contract, but says there is no evidence of exploitation and that existing user funds on ZKsync remain safe. The issue affects only the specific wstETH bridge endpoint to ZKsync; other Lido bridges and protocols are reported to be unaffected, and withdrawals from ZKsync as well as token transfers continue to operate normally. According to Lido’s disclosure on X and subsequent coverage, the weakness was identified in the contract logic that handles transfers of wrapped staked Ether (wstETH) between Ethereum mainnet and the ZKsync Layer 2 network. In line with its documented bridge safety practices, Lido used its emergency controls to pause new deposits as a precautionary measure while leaving users’ ability to move or withdraw existing wstETH on ZKsync intact. Lido has prepared a contract fix that will first go through an external audit and then be deployed via the next scheduled on-chain Lido DAO governance vote, expected in late March or early April, after which deposit functionality is planned to be restored. No technical exploit details have been made public yet, beyond describing the issue as a “potential weakness” in the endpoint logic. This incident underscores the ongoing security risks around cross-chain bridges, which remain critical infrastructure for moving liquidity between Ethereum and Layer 2 ecosystems. Although this case involves preventive action rather than a confirmed hack, disclosures of vulnerabilities can still draw attacker attention during the window before a fix is live, making monitoring and governance processes especially important. For users, the immediate impact is mainly operational: they cannot initiate new wstETH deposits to ZKsync via the affected bridge, but they can continue to manage existing balances on ZKsync and withdraw back to Ethereum as needed.

✨ AI-generated background, compiled from web sources — not editorial content.

More coverage

• Lido Identifies ZKsync wstETH Bridge Endpoint Contract Vulnerability (cryptonews.net)
• Lido Finance pauses deposits due to security flaw in ZKsync wstETH ... (cryptopolitan.com)
• Lido Suspends ZKsync wstETH Bridge Deposits - Trustformer KYT (trustformer.info)
• Lido: ZKSync wstETH Bridge Endpoint Contract Vulnerability - Bitget (bitget.com)
• Lido: Potential Vulnerability in ZKsync wstETH Bridge End - KuCoin (kucoin.com)

Explore the topic

• wstETH
• ZKsync