Turning validator best practice into an auditable standard

Lido spreads one of the largest pools of staked ETH across many independent node operators. Each ran its own security, key custody and incident-response practices, and no shared, auditable bar existed.

Nobody could easily answer the question an institution asks before staking: how do I know this operator is safe?

• Supported the community effort to define operator best practice, from the earlier DUCK initiative through to ValOS, over roughly three years.
• DUCK produced a risk framework, a mitigation and controls library, and a communications toolkit. ValOS builds on it with governance and organisational structures, so the standard can be used in professional audits.
• TBC: Lionscraft's specific contribution, e.g. authored the risk framework, ran working groups, coordinated contributors, drafted the controls library

• ValOS went live in August 2026, funded by Lido DAO through its LEGO grants programme.
• Lido set aside a $60K grant pool (DUCK FLAP) that covers up to 50% of assurance-review costs for node operators who adopt it early.
• The standard is aligned with ISO 27001 and SOC 2 and published open source, so any operator can be assessed against it.
• TBC: number of operators that have adopted ValOS or completed an assurance review

• Crypto Briefing: Lido funds ValOS
• KuCoin News: ValOS