Partnered With:

Taking stock of EigenLayer re-pledge risks and best operating practices

Read this article in 11 Minutes

This article investigates the mainstream Restaking protocols and mainstream LST assets on the market, and sorts out the related risks.

Original Title: "Risks and Best Practices for Re-Staking EigenLayer"

Original Source: Cobo Security Team, Cobo Global

With the rise of Restaking, there have been many Restaking projects based on Eigenlayer in the market. Restaking aims to share the trust of the Ethereum Beacon staking layer, allowing users to share their staking shares with other projects, thereby enabling users to earn more profits while allowing other projects to enjoy the same consensus trust and security as the ETH Beacon layer.

In order to help everyone better understand the interaction risks between different Restaking projects, the Cobo security team has conducted research on mainstream Restaking protocols and mainstream LST assets on the market, and sorted out the relevant risks, so that everyone can better control the corresponding risks while enjoying the benefits.

Note: The relevant conclusions listed by Cobo Security Team are based on UTC time before 0:00 on February 5, 2024.

Risk Point Overview

Currently, most of the Restaking protocols on the market are built on EigenLayer. For users, participating in Restaking means exposing themselves to the following risks:

Contract Risk

1. Currently, participating in Restaking requires interacting with the project's contract, and users need to bear the risk of the contract being attacked.

2. The project funds based on EigenLayer will ultimately be stored in the contract of the EigenLayer protocol. If the EigenLayer contract is attacked, the related project funds will also suffer losses.

3. In EigenLayer, there are two types of Restaking: native ETH Restaking and LST Restaking. For LST Restaking, funds are directly deposited into the EigenLayer contract. However, for Native ETH Restaking, funds are deposited into the ETH Beacon chain. This means that users who perform LST Restaking may incur losses due to EigenLayer contract risks.

4. The project party has high-risk permissions, and in some cases, user funds can be misappropriated through sensitive permissions.

LST Risk

There is a possibility of LST token being unanchored, or deviation and loss of LST value due to LST contract upgrade/attack.

Exit Risk

Currently, except for EigenLayer, mainstream Restaking protocols on the market do not support withdrawals. Assuming the project party has not upgraded the corresponding withdrawal logic through the contract, users will never be able to retrieve their assets and will need to obtain liquidity exit from the secondary market.

According to the listed risk points above, the Cobo security team conducted a systematic investigation of some mainstream Restaking protocols in the market and sorted them out. Currently, they mainly include:

1. The completion rate of the project is low, and most of the projects have not implemented the withdrawal logic.

2. Centralized risk: User assets are ultimately controlled by a multi-signature wallet. The project team has a certain ability to perform a Rug Pull.

3. Based on the second point, in the event of internal malfeasance or loss of multi-signature private keys, asset losses may occur.

In order to make the results more intuitive, the Cobo security team has organized and classified the research results for easy viewing, as follows:

Due to EigenLayer being the cornerstone of all projects, in addition to the points mentioned in the table, there are several other points that users need to pay attention to:

1. The EigenLayer is currently deployed in the mainnet contract and has not fully implemented all the functions in its whitepaper (AVS, slash). Among them, the slash function only implements the relevant interface and does not have a specific complete logic. According to the contract code, the current slash is triggered by the owner (project admin authority) of the StrategyManager contract, and the execution method is relatively centralized.

2. During the process of EigenLayer native ETH Restaking, in addition to creating an EigenPod contract for fund management, users also need to run their own Beacon chain node service and bear the risk of being slashed by the Beacon chain. It is recommended that users choose a more reliable node service provider when performing native ETH Restaking. In addition, since ETH is stored in the Beacon chain, when withdrawing funds, users not only need to initiate the process themselves, but also need the node service provider to help them withdraw the relevant funds from the Beacon chain, which requires mutual agreement.

3. Due to the incomplete implementation of AVS and Slash mechanisms in EigenLayer, the Cobo security team recommends that users do not enable the delegate function in the EigenLayer protocol without understanding the related risks, otherwise it may cause certain financial losses.

In addition, through code review, some projects also have some code risks that may affect user fund security. Cobo discovered the relevant risks and immediately communicated with the project team for confirmation. Some risk points and communication results are as follows:

EigenPie

Currently, all contracts in the protocol are upgradable contracts, with upgrade permissions of 3/6 Gnosis Safe. However, the upgrade permissions for the MLRT token contracts of cbETH, ethX, and ankrETH are EOA addresses.

Cobo has contacted the Eigenpie team before the deadline. The project team responded that they will grant upgrade permissions for all MLRT tokens to the multi-signature wallet within 24 hours.

KelpDAO

During the recharge process, when calculating the share portion that the user receives, it is necessary to calculate the value of the share. However, the rsETHPrice in the calculation formula needs to be manually updated to correspond to the oracle. Except for stETH, the share price of the corresponding token contract is used as the price source. stETH is directly converted at a 1:1 ratio. When stETH is discounted in the secondary market, there will be a certain arbitrage space during the recharge process.

KelpDAO responded on February 5th that the exchange rate for the Lido contract is named 1 stETH = 1 ETH. However, since KelpDAO has not yet opened its withdrawal function, arbitrageurs cannot take advantage of this strategy. To address this issue, the KelpDAO team will add a circuit breaker mechanism when withdrawals are launched to check the market price of stETH, compare it with the contract price of stETH, and apply necessary safeguards when there is a significant deviation.

Renzo

OperatorDelegator is responsible for routing protocol funds to EigenLayer and corresponding to different recharge ratios. However, during the configuration process of OperatorDelegator, the protocol did not check whether the ratios of all OperatorDelegators were greater than 100%, which may result in the situation where OperatorDelegator-1 (70%) and OperatorDelegator-2 (70%) coexist. This issue mainly affects user fund withdrawals. Due to the incomplete withdrawal logic, it is impossible to evaluate the specific impact on the principal.