TL;DR
- What it is: Non-rebasing wrapper of eETH, ether.fi’s liquid restaking token. Pooled ETH (1,907,736 ETH ≈ $3.2B, 2026-07-02) staked on permissioned DVT validators; a shrinking slice natively restaked into EigenLayer.
- Yield source: Ethereum consensus + execution/MEV rewards — realized ~2.5% net on-chain. The restaking leg is legacy emissions, effectively zero cashflow today.
- Biggest risk: weETH is the dominant looped collateral on Aave — an LRT-sector shock forces a deleveraging wave into a queue-gated exit at a temporary discount (Risk #1; the channel that fired in the Apr-2026 Kelp incident, which weETH survived).
- For detail: LlamaRisk weETH assessment (2024-06), Gauntlet LRT slashing report (2024-12). No current third-party reassessment exists — the 2024 admin-key findings are obsolete; we verified the replacements on-chain.
How it works
Deposit ETH, receive rebasing eETH; weETH wraps it non-rebasing (rate 1.098327, 2026-07-02). Pooled ETH goes to permissioned node operators in DVT clusters (SSV/Obol). Each validator’s withdrawal credentials point at a per-validator EtherFiNode contract owning an EigenLayer EigenPod — the “native restaking” (verified: node 0x0B72…086a → pod 0x9EB1…7e78 → operator 0x6794…e051). ether.fi — not the holder — picks EigenLayer operators and AVSs; stated policy is no slashable AVS opt-ins, with the restaked share cut from ~half of TVL in early 2026 toward <20% by Q3 2026 (docs, 2026-07-02 — a target on trust, not a verified fact).
Oracle: NAV is ether.fi’s own 2-of-3 committee of protocol keys (“to be expanded to 3-of-5 by end July 2026” — docs governance table, verified quote 2026-07-02; still 2-of-3 on-chain); reports rebase eETH via EtherFiAdmin, capped at 5% annualized per report (verified). Nothing inside the protocol liquidates, and Aave prices weETH off the capped internal exchange rate (CAPO adapter 0x8762…6d4C, verified), not market price — a market depeg alone doesn’t liquidate the loops.
Yield decomposition: gross ~2.8% (ether.fi / DefiLlama base 2.74%, both 2026-07-02) is base staking — organic cashflow, an MEV-passive premium, split 90/5/5 holders/operators/treasury (docs). Realized net from the on-chain rate: 2.49% (30d), 2.42% (90d), 2.53% (1y). The restaking leg is ≤0.07% legacy emissions (KING — distribution ended 2025-01-27 per docs archive; points seasons over): the incentives-stop scenario already happened and yield didn’t move. Base staking is network-wide, so the carry doesn’t compress as ether.fi’s TVL grows.
Label vs exposure: marketed as a restaking token, weETH today is functionally a plain ETH LST (shrinking restaked sleeve, none slashable per policy) — while 61% of its supply is re-hypothecated on Ethereum Aave v3 alone (verified; more on L2 deployments).
Restaking primer
(Added for this eval — background for the yield decomposition above.)
Ordinary staking pledges 32 ETH per validator as collateral securing Ethereum itself; the collateral earns consensus + MEV rewards and is slashed only for Ethereum-protocol violations. Restaking re-pledges that same collateral a second time — via EigenLayer, the staked ETH also secures third-party services (“AVSs”: oracle networks, data-availability layers, bridges) that need economic security but have no validator set of their own. The deal: extra reward from each AVS, in exchange for accepting that AVS’s additional slashing conditions on the same ETH.
The chain of actors: a restaker (here ether.fi, on behalf of all eETH/weETH holders) delegates its stake to an EigenLayer operator, who runs the AVS software and chooses which AVSs to opt into. Slashing is scoped per AVS (“unique stake” — one bad AVS can’t slash everything), and since ELIP-006 a slash of LST-restaked stake can be redistributed to the AVS rather than burned; natively restaked ETH is excluded from redistribution and can only be burned. ether.fi’s variant is native restaking: validator withdrawal credentials point directly at an EigenPod, so the beacon-chain ETH itself is the pledged collateral — no wrapped-LST hop.
Why it stopped paying: selling security is only worth what buyers pay, and AVSs so far have paid mostly in their own token emissions (EIGEN and the like) to bootstrap — real fee-paying demand for restaked security hasn’t materialized. Once those emissions ended (Jan-2025 for ether.fi’s KING channel), the restaking premium went to ~zero while its slashing tail stayed — which is why ether.fi keeps its stake out of slashable AVSs and is shrinking the restaked share. The label persists; the carry is plain staking.
Risks
Verified on-chain (2026-07-02, block 25445475): supplies, rate + realized APY, 10d timelock + 6/10 Safe signer composition, 2-of-3 oracle quorum + 5% rebase cap, EigenPod wiring + delegation, Aave share + LTV/eMode + CAPO source, LP buffer + queue depth, Curve depth, pauser/unpauser roles, instant-redemption fee 30bps + 1%-TVL watermark (tokenToRedemptionInfo), EigenLayer 14d escrow. Taken on trust: no-slashable-AVS policy + <20% restaked-share target + 3-of-5 oracle expansion (docs), Apr-2026 stress statistics (ether.fi docs — independently corroborated on-chain within 2%, but DEX marks diverge, see Liquidity), 90/5/5 fee split (docs).
| # | Risk | Mechanism | Source + our delta |
|---|---|---|---|
| 1 | Reflexive Aave concentration → congested exit at a discount | 981,079 weETH (61% of supply) in Aave v3 Ethereum — 77.5% base LTV, dominant loopers in eMode (93% LTV / 95% LT). Sector shock → deleveraging into the queue: Apr-2026 worst redemption 16.7d, ~−0.8% daily-VWAP trough. Exit: peg <−1% sustained 24h, or queue median >7d. | Gauntlet (2024-12) modeled ~7× amplification via Aave loops; Apr-2026 Kelp incident (unbacked-mint exploit — same channel, different trigger) confirmed it; weETH held. Concentration re-verified on-chain today. |
| 2 | Upgrade-key compromise | weETH/eETH/LiquidityPool are UUPS proxies owned by a 10-day timelock (0x9f26…0761); sole proposer/executor/canceller is a 6/10 Safe (9 bare EOAs + one 2/7 Safe) — no independent veto. Hostile 6/10 → drain after 10d. Exit: any unexpected timelock queue tx. | LlamaRisk (2024-06) flagged 2/6, no timelock — obsolete; verified materially better today. Immunefi bounty now $500k (2026-07-02) — raised since LlamaRisk’s $200k critique (2025-09), still thin vs $3.2B. |
| 3 | Oracle-committee NAV distortion | 2-of-3 protocol-internal committee publishes beacon balances; EtherFiAdmin bounds each rebase at 5% annualized — caps inflation to a slow skim, but reports also gate withdrawal finalization. Exit: rebase near cap, or unexplained committee change. | LlamaRisk (2024-06) flagged quorum-1; now 2-of-3 (verified). We add: still fully protocol-internal — no external attestation of backing. |
| 4 | Restaking risk re-expansion | ”No slashable AVS” is policy, not code. EigenLayer slashing live Apr-2025; ELIP-006 redistribution excludes natively restaked ETH, so opted-in ether.fi stake would be slashable/burnable, not confiscatable. Re-evaluate: restaked share rising, or any slashable opt-in. | ether.fi docs (on trust); no mainnet slashing incident found to date. External reports pre-date the policy — our addition. |
| 5 | Pause liveness | EOA 0x9AF1…844D holds PROTOCOL_PAUSER (alongside EtherFiAdmin and a 4/7 Safe) — one key freezes deposits/withdrawals instantly and cannot self-unpause (4/7 required). Deliberate fast-brake design. Exit: unexplained pause >24h. | Our on-chain read; surfaced in no external report. |
| 6 | Consensus slashing, socialized | Permissioned operators post no bonds; an ordinary slash (~0.008 ETH/validator post-Pectra) rebases across all holders. Never slashed to date (on trust). | LlamaRisk (2025-04): Pectra cut initial slash penalty ~128×; we agree it’s a tail, not a driver. |
Key-compromise threshold
- Funds (theft / unbacked mint / burn): 6 of 10 — the timelock-proposer Safe (signers verified: 9 bare EOAs + one 2/7 nested Safe) queues a malicious UUPS upgrade; it executes after 10 days and can drain the pool. The delay is the exit window; the same Safe holds the canceller role, so no one else can stop it. Slow path: 2 of 3 oracle keys can over-report NAV, capped at 5% annualized — bounded skim, not a drain.
- Liveness (freeze / NAV distortion / forced exit): 1 — the pauser EOA freezes deposits and withdrawals (recovery via the 4/7 operational Safe; the EOA cannot self-unpause). 2 of 3 oracle keys going silent also stalls withdrawal finalization.
- Single point of failure: yes — liveness only: the pauser EOA, plus a second narrower ops key (oracle-task-manager EOA
0x1258…1B0F); both reversible by design. No single key reaches funds.
Liquidity & exit
Primary: fee-free withdrawal queue at NAV — request mints a WithdrawRequestNFT, finalized per oracle report. open requests = 163 · LiquidityPool buffer = 22,853 ETH (block 25445475). Apr-2026 sector stress: 542,792 ETH (19.6% of TVL) redeemed in 33 days — median 4.9d, max 16.7d (ether.fi docs; corroborated on-chain within 2%, Dune 7868242/7868260) — settling at oracle NAV by mechanism. DEX marks at the trough: −0.82% daily VWAP / −1.47% worst hour (our Dune read; ether.fi self-reports −0.58%). Instant: RedemptionManager, 30bps fee while the buffer exceeds 1% of TVL (tokenToRedemptionInfo, verified). DEX fills only small clips: Curve weETH/WETH does 1,000 weETH at −0.21%, saturates ~1,400 (pool WETH = 1,409) — at size, the queue is the only exit. Unwinding the restaked sleeve adds EigenLayer escrow (minWithdrawalDelayBlocks = 100,800 ≈ 14d, verified) plus the beacon exit queue.
Defensible size at current liquidity: $50M (≈29.5k ETH, 1.5% of the pool) — ~2 days of Apr-2026 stressed queue throughput (~16.4k ETH/day), inside the observed ~5d median. No DEX haircut is quotable at this size (the pool breaks two orders of magnitude earlier); the exit cost is time — up to ~2.5 weeks worst observed — plus ~−0.8% mark-to-market while waiting.
Stress scenario: NOCA exits 50% ($25M) in 7d during a peer run: the instant path’s watermark breaches, everything queues, and the Apr-2026 distribution clears most claims in 1–2.5 weeks at NAV, marking −0.8% to −1.5% intra-period. The binding constraint is time, not price.
External reviews
- LlamaRisk — weETH collateral risk assessment · 2024-06-08 · ⚠️ stale — admin-key facts obsolete (see Risks 2–3)
- Chaos Labs — weETH Aave v3 onboarding ARFC · 2024-02-28 · ⚠️ stale
- Gauntlet — LRT lending health & slashing report · 2024-12-20 · ⚠️ stale
- LlamaRisk — LRT/wstETH E-mode unification analysis · 2025-04-10 · ⚠️ stale
- Aave Risk Stewards (LlamaRisk) — weETH cap actions · 2026-07-01
- ether.fi — audits registry (30+ reports) · Immunefi $500k bounty · 2026-07-02
- DeFiScan — no ether.fi review exists (checked 2026-07-02); no comprehensive independent reassessment newer than mid-2024 — a coverage gap, and why our on-chain verification above is load-bearing.