.svg){kind=icon}
Now hiring!
The new security reality is attackers pairing AI with protocol knowledge to probe code at machine speed. Lido launched the Evergreen initiative to find out whether AI-assisted review could add real, continuous value on top of its existing audits. Nethermind Security was chosen as the implementation partner, with a four-week pilot scoped on already-audited Lido Core, the framework inside Lido’s liquid staking protocol. The pilot brought together AuditAgent customized for Lido, AgentArena running competitions in parallel, a structured set of Lido-specific documentation feeding both, and Nethermind Security researchers grounding the work at each stage.
We covered roughly 19,000 of Lido Core's 31,000 lines of code with two AI engineers and two security researchers. We split that into two clusters, each grouped around a set of economic invariants so it could be read as a complete flow: the Core Pool (16 contracts, where pooled stETH has to rebase correctly so no holder is diluted and no withdrawal is mispriced) and the V3 stVaults system (23 contracts, where each vault's minted stETH has to stay backed by proven collateral, with consensus-layer proofs and exit verification).
The engagement had three parts:
The piece that tied the effort together was a structured rewrite of Lido Core's documentation, built for agents to efficiently read and understand.
Each cluster had its own researcher, who pulled out its invariants and checked what the agents flagged. With that context, the agents reached the places where protocol-specific reasoning changes the risk: invariant and property checks (rebase accounting, stake rate limits, validator exits, predeposit guarantees), access control and upgrade paths, economic exposure, and regression checks on new code. That included the contracts around the oracle reporting flow, though not the oracle infrastructure itself.
Audits are an indispensable part of security. But they only cover a snapshot, while protocols teams keep shipping code, shifting dependencies, and facing new attack patterns long after an audit ends. Nethermind Security's approach combines both: audits and continuous, AI-driven analysis, reinforcing each other across the protocol lifecycle.
The Lido pilot is the first test under Lido's Evergreen initiative, and it's where that combination played out. The code had already been audited, so the work started from a reviewed baseline. The engagement ran in three stages over four weeks: baseline runs of AuditAgent and AgentArena, then customization, then final competition rounds on the tuned setup. Security researchers validated results at each stage.
In a single 24-hour pass, AgentArena's competing agents surfaced the widest set of issues. AuditAgent's best-grounded configuration cracked the single hardest multi-step issue, which none of the competitions did. Neither tool caught everything on its own. The best coverage came from running both together, with the researchers guiding them.
No bugs were planted in the code, so "ground truth" here is just what the pilot surfaced. The percentages below are coverage of that set. False positives were fed back into the documentation, so each round started better grounded than the last.
In AgentArena, customization raised coverage in both clusters: from 67% to 83% in the one that already scored well, and from 44% to 78% in the weaker one. Each agent also produced a fifth to a quarter less noise. AuditAgent moved the same way as its context deepened: coverage of the surfaced issues went from about a third to all of them in one cluster, and from zero to all of them in the other, while total output dropped about 40% as false positives fell from roughly a third of the report to under a fifth.
The gain held across both tools, with no regressions. Our answer to Lido’s question: Protocol-specific AI systems provide security value beyond generic tooling.
The pilot builds on years of our security work across Ethereum, including with Lido:
This pilot covered AuditAgent and AgentArena engagements on parts of Lido Core. Evergreen can grow from here in two ways: across the rest of the Lido codebase, and into runtime coverage. That means monitoring connected protocols for signs of compromise, a scanner for offchain components, and ongoing AuditAgent and AgentArena runs across more repositories.
Nethermind Security's approach combines all three: audits, continuous AI-driven analysis, and monitoring, each reinforcing the others across a protocol's lifecycle rather than working as separate, disconnected engagements.
The pilot delivered a customized AuditAgent with new detectors, four AgentArena competitions, and the structured documentation that made the agents protocol-aware. It also produced a triaged set of findings, some new to the Lido team, others that matched complex issues previously raised through bug bounties.
Lido saw enough in the results to expand the engagement, adding two more repositories and new detectors. Protocols that stay ahead on security tend to adopt the next layer before the rest of the field agrees it's needed. That layer now is continuous, agent-driven coverage, and Lido is already running it.
“The goal of Evergreen isn’t to replace traditional security reviews – it is to explore whether AI can become another useful layer in the everyday security process at Lido. This pilot gave us confidence that, when combined with protocol-specific context and experienced researchers, it can. There’s still a lot to learn, but the results were strong enough that expanding the initiative felt like the natural next step.” - Gregory S, Lido Audit Facilitator
If you're weighing how to extend security coverage before and after an audit, that conversation starts at nethermind.io/nethermind-security.
The Leading Engineers of Blockchain Infrastructure
Nethermind © 2026
.svg)
.svg)
.svg)
.svg)
.svg)
.svg){kind=icon}
.svg)
.svg)
.svg)
.svg)
.svg)