Risks and best operating practices of EigenLayer re-staking

Author: Cobo Security Team

With the rise of Restaking, more Eigenlayer-based Restaking projects have appeared on the market. Restaking is intended to share the user's pledge share with other projects by sharing the trust of the Ethereum Beacon pledge layer, allowing users to gain more benefits while allowing other projects to enjoy the same consensus trust and security as the ETH Beacon layer. .

In order to help everyone better understand the interaction risks between different Restaking projects, the Cobo security team conducted a survey on the mainstream Restaking protocols and mainstream LST assets on the market. , and sorted out the relevant risks, so that everyone can better control the corresponding risks while enjoying the benefits.

• Note: The relevant conclusions listed by the Cobo security team are based on UTC time on February 5, 2024 Before 0 o'clock.

Overview of risk points

Restaking currently on the market The protocol is basically built based on EigenLayer. For users, participating in Restaking means exposing themselves to the following risks:

Contract risk

LST risk

• LST tokens may become unanchored, or the LST contract may be upgraded/attacked, causing deviations and losses in the value of LST.

Exit risk

• Currently, except for EigenLayer, the mainstream Restaking protocols on the market do not support withdrawals. Assuming that the project party does not upgrade the corresponding withdrawal logic through the contract, users will never be able to get their assets back and will need to obtain liquidity from the secondary market to exit.

Based on the risk points listed above, the Cobo security team systematically investigated some of the mainstream Restaking protocols currently on the market and conducted Comb. At present, it mainly includes:

1. The project completion is low, and most projects do not implement withdrawal logic;

2. Centralization risk: User assets are ultimately controlled by multi-signature wallets. The project side has certain Rug Pull capabilities;

3. Based on the second point, when there is internal evil or multi-sign private keys If lost, asset damage may occur.

In order to make the results more intuitive, the Cobo security team organized and classified the survey results for everyone to view, as follows ：

Since EigenLayer is the cornerstone of all projects, in addition to the ones mentioned in the table, there are also the following points that users need to pay attention to:

1. EigenLayer is currently deployed in the contract of the main network and has not fully implemented all the functions in its white paper (AVS, slash). Among them, the slash function only implements the relevant interfaces and does not yet have specific and complete logic. According to the contract code, the current slash is triggered by the owner of the StrategyManager contract (admin authority of the project party), and the execution method is relatively centralized;

2. In the process of EigenLayer native ETH Restaking, in addition to creating an EigenPod contract for Restaking fund management, you also need to run the Beacon chain node service yourself and bear the risk of being slashed by the Beacon chain. When users perform native ETH Restaking, it is recommended to choose a more reliable node service provider. In addition, since ETH is stored in the Beacon chain, during the withdrawal process, in addition to being initiated by the user, the node service provider also needs to help the user withdraw the relevant funds from the Beacon chain, that is, the withdrawal process requires the consent of both parties. ;

3. Since EigenLayer has not yet implemented the complete AVS and Slash mechanisms, the Cobo security team recommends that users not understand the related risks before Enable the delegate function in the EigenLayer protocol, otherwise it may cause certain financial losses.

< /p>

In addition, through code review, some projects also have some code risks that may affect the security of user funds. When Cobo discovered relevant risks, it immediately communicated and confirmed with the project team. Some risk points and communication results are as follows:

EigenPie

• All contracts in the current agreement are upgradeable contracts, and the upgrade rights are 3/6 Gnosis Safe  However, the upgrade rights of the MLRT token contracts of cbETH, ethX, and ankrETH in the MLRT token are EOA addresses .  

Cobo has contacted the Eigenpie team before the deadline, and the project team responded that all MLRT tokens will be transferred within 24 hours The upgrade permission is given to the multi-signature wallet.

KelpDAO

• During the recharge process, when calculating the share obtained by the user, the share value needs to be calculated, but the rsETHPrice in the calculation formula needs to be manually updated with the corresponding oracle. Except for stETH, the share price of the corresponding token contract is used as the price source. stETH directly adopts 1:1 conversion. When stETH is discounted in the secondary market, there will be a certain amount of arbitrage space during the recharge process.

KelpDAO responded on February 5 that the exchange rate of the Lido contract was named 1 stETH = 1 ETH because KelpDAO is not yet open. Withdraw function, arbitrageurs cannot take advantage of this strategy. In response to this issue, the KelpDAO team will add a circuit breaker when withdrawals are launched that will check the market price of stETH, compare it with the contract price of stETH, and apply necessary guardrails if the deviation is large.

Renzo

1. OperatorDelegator is responsible for routing protocol funds to EigenLayer and corresponding to different recharge ratios. However, during the process of configuring OperatorDelegator, the protocol did not check whether the proportions of all OperatorDelegators are greater than 100%, resulting in the possibility of OperatorDelegator-1 (70%) and OperatorDelegator-2 ( 70%) situation. This problem mainly affects users’ fund withdrawals. Since the withdrawal logic is currently incomplete, it is impossible to evaluate the specific impact on the principal.  

The Renzo team stated that in this specific case funds were transferred to the incorrect OperatorDelegator contract for deposits, Or extracted from an incorrect OperatorDelegator. Renzo stated that although this technical issue will cause a mismatch in Renzo’s expected allocations to different operators, it will not affect the calculation of total value locked (TVL) or the security of funds. At the same time, the Renzo team will upgrade the contract in the future to solve this technical problem.

In addition to the risks of the protocol itself, the risks of LST cannot be ignored during the restaking process. The Cobo security team also conducted research on the mainstream LST tokens on the market and will The results are organized for everyone to view, as follows:

< /p>

How to effectively reduce the risks of participating in Restaking?

Restaking is an emerging concept. Neither the contract layer nor the protocol layer has passed the test of time. In addition to the above-mentioned risks of consolidation, there may also be Other unknown risks. So is there a relatively safe best interaction guide that can effectively reduce risks during interaction?

Based on the current research conclusions, the Cobo security team has compiled a relatively safe interaction path for everyone.

Fund Allocation

For users who use larger funds to participate in Restaking, participate directly EigenLayer’s Native ETH restaking is a good choice. The reason is that for Native ETH restaking, the recharged ETH assets are not stored in the EigenLayer contract, but in the Beacon chain contract. Even in the worst case scenario where a contract attack occurs, the attacker cannot immediately obtain the user's assets.

For users who also want to use large funds to participate but are not willing to endure a long redemption time, they can choose the relatively safe stETH as a participating asset to participate directly. EigenLayer.

For users who want to earn extra income, they can choose a part of the funds to participate based on their risk tolerance, such as Puffer, KelpDAO, Eigenpie and Renzo, which are based on Projects built by EigenLayer, but it should be noted that since none of the above projects currently implements the corresponding withdrawal logic, users participating in such protocols need to consider the corresponding exit risks at the same time, and should also consider the relevant LRT at the secondary level during the investment process. Market liquidity.

Monitoring configuration

The projects listed in the article currently have the ability to upgrade and suspend contracts. At the same time, multi-signing by the project party can also perform high-risk operations for the project. For advanced users, you can configure corresponding contract monitoring to monitor related contract upgrades and the execution of sensitive operations of the project side.

At the same time, teams and users who want to invest in ETH and participate in projects can cooperate with Cobo Argus to trigger automated robots and single-signature authorization configurations for Safe multi-signature wallets, based on The TVL changes of the pool, the fluctuation of ETH price and the actions of giant whales are used to set the automatic deposit function to EigenLayer and each re-pledge agreement.