TL;DR
- What it is: earnETH (
0xBBFC…fea0A4), a Mellow “Core Vault” DeFi meta-vault under the Lido Earn brand — ≈$160M, almost entirely the Mellow stRATEGY sub-vault, which runs a book of leveraged LST/LRT-vs-WETH Aave loops. Not a Lido V3 stVault. - Yield source: LST staking yield minus the WETH borrow rate, levered ≈10× on Aave — ≈half of NAV is loop equity, the rest unlevered staked ETH. Net of a 1% AUM + 10% performance fee.
- Biggest risk: a live, razor-thin leveraged rsETH loop is on again at about the size it held when Kelp’s bridge was drained in Apr-2026 — an LST/LRT depeg liquidates it into a lending market that has frozen before (Risk #1).
- For detail: Lido gov — Kelp Incident Review (11579), Aave rsETH incident report (24580). No independent risk rating of EarnETH exists yet.
How it works
Deposit ETH / WETH / stETH / wstETH, receive auto-compounding earnETH shares. The token is a Mellow share-manager over a Core Vault (0x6a37…249e) allocating across two sub-vaults — stRATEGY (Mellow) and GGV (Veda’s BoringVault). Today it is ≈96.9% stRATEGY; GGV is negligible, plus a thin wstETH/ETH buffer. Launched Mar 2026, it is a Lido brand product on Mellow rails — not a Lido V3 stVault (those route into EarnETH via a DeFi-Wrapper connector, per Lido docs).
Oracle: NAV is curator-published, not market-priced — a Mellow oracle (0xAda1…0358) takes submitReports((asset, priceD18)[]) from a 3-of-8 reporter Safe, and batched redemptions settle at the last report. No market feed at the meta-vault level; the only liquidation surface is one layer down, in the sub-vaults’ Aave loops.
Yield decomposition: stRATEGY runs a book of leveraged loops (verified 2026-07-06, block 25473479): a wstETH/WETH loop (0x893a…0080, HF 1.06), a rsETH/WETH loop (0xCDfA…9c89, ≈113k rsETH, HF 1.035, ≈12×), and a lighter wstETH→stablecoin (USDe/USDT) carry — together ≈$573M gross collateral on ≈$79M net equity (≈half of NAV), each earning an LST or stable carry minus the borrow rate; net of 1% AUM + 10% performance (verified on the FeeManager). No emissions, but the carry compresses as it scales — more WETH borrowed lifts the rate — and inverts when rates spike, as in April.
Label vs exposure: marketed as an “ETH growth vault,” EarnETH is really ≈half unlevered staked ETH and ≈half net equity in ≈10× loops — and the tightest, most fragile leg is rsETH, the restaking token whose bridge was drained in April, held at about the size it carried then. Only the live Aave positions show this; the name doesn’t.
Risks
Verified on-chain (2026-07-06, block 25473479): sub-vault wiring; 96.9%-stRATEGY composition; all 8 stRATEGY subvaults’ Aave positions — incl. a live ≈$217M / 113,216-rsETH loop at HF 1.035; ≈92k ETH NAV; 1%/10% fees; 5/8 upgrade Safe (8 bare EOAs, no timelock) + 5/8 ops Safe + 3/8 reporter Safe; open deposits (empty whitelist root). Taken on trust: Apr-2026 incident figures + ≈144 ETH loss (Lido gov), report correctness, Nethermind audit scope (report not located).
| # | Risk | Mechanism | Source + our delta |
|---|---|---|---|
| 1 | Live leveraged rsETH loop — the April position, rebuilt | Subvault 0xCDfA…9c89: ≈113,216 rsETH (≈$217M) vs ≈111,745 WETH, HF 1.035, 95%-LT eMode, ≈12× — about the size held when Kelp’s bridge was drained. A depeg liquidates it into a market that froze before. Exit if HF <1.03, or rsETH <−1% vs ETH 24h. | Lido gov 11579: April ≈9% / ≈$21.6M, ≈144 ETH loss, exited at NAV only because DeFi United re-backed rsETH. The loop is on again at ≈113k rsETH / HF 1.035. |
| 2 | Whole book is ≈10× levered at HF ≈1.03–1.06 | Beyond rsETH, a wstETH/WETH loop (0x893a…0080, HF 1.06) plus lighter legs run ≈$573M gross collateral on ≈$79M net equity. Correlated loops hold until a peg breaks or rates spike, then delever at once. Exit if any aggressive loop HF <1.03. | Our on-chain read across all 8 subvaults; no external rating exists. |
| 3 | Curator-published NAV | Share price is a pushed oracle report (submitReports, 3/8 reporter Safe), not a market feed, with no independent attestation. Exit if report cadence stalls, or NAV diverges from look-through Aave value. | Mellow docs describe oracle-priced redemption; the mark is curator-internal — integrity rests on the reporter + ops Safe. |
| 4 | Instant 5-of-8 upgrade, no timelock | Token + Core Vault are TransparentUpgradeableProxies; one 5/8 Safe (0x8169…0Af0, 8 bare EOAs, no timelock) owns both ProxyAdmins → a hostile 5/8 swaps in a draining impl in one tx. Exit if any unexpected upgrade or admin-role change. | Our on-chain read; no external governance rating exists. |
| 5 | Queue-gated exit that froze 27 days | Redemption is a batched queue at oracle NAV (“up to 72h”), but settlement needs curators to unwind the loops — rsETH is the illiquid leg. In April, deposits and withdrawals paused 27 days. Exit if withdrawals paused >72h, or a batch unsettled >7d. | Lido gov 11579 (27-day pause) — the observed worst-case latency. |
| 6 | Recursive contagion + thin coverage | Look-through concentrates in Aave (both loops) and touches Spark and Ethena (USDe); a freeze or bad-debt event propagates into NAV and blocks the unwind. New code (Feb 2026, <6m); no EarnETH-specific Nethermind report locatable, Lido’s audit index omits it. | Aave report (24580) documents the April freeze; no independent risk rating yet. |
Key-compromise threshold
- Funds (theft / unbacked mint / burn): 5 of 8 — the upgrade Safe (
0x8169…0Af0; 8 bare EOAs) owns both ProxyAdmins and swaps in a malicious implementation with no timelock, draining in one tx. No faster path, no delay window. - Liveness (freeze / NAV distortion / forced exit): 5 of 8 — the ops Safe (
0x0Dd7…076E) pauses withdrawals and sets allocations; or 3 of 8 — the reporter Safe (0x93a7…35D1) stalls or distorts the pushed NAV that redemptions gate on. - Single point of failure: none reaches funds. Upgrade and ops Safes share 3 of 8 signers; the reporter is a separate 3/8 — but with no timelock anywhere, the funds-trust floor is one 5/8 signer set.
Liquidity & exit
Primary: batched redeem queue at oracle NAV (“up to 72h”); settlement needs curators to unwind the loops. The wstETH legs unwind cheaply; the rsETH leg is the illiquid-in-stress one — in April the queue froze 27 days. Instant buffer is thin (≈116 ETH + 90.5 wstETH). Backup: none — earnETH has no secondary DEX pool (no Uni V2/V3 pair); the queue is the only exit.
Defensible size (post-haircut): ≈$20M (≈12% of NAV) — clears within the 72h SLA in calm markets via the liquid wstETH legs, where the cost is time, not slippage. But the binding constraint is the rsETH loop: an LST-depeg run freezes the queue (April: 27 days) and realizes the loss unless backing is externally restored again. Size to the pause, not the SLA.
Stress scenario: exit 50% ($10M) in 7d during a depeg — the queue pauses, gates to weeks, NAV is the curator mark, and the rsETH loop (HF 1.035) liquidates into the freeze. Provisional (leveraged, <6m live, re-levered into the asset that already failed) — halve the cap until refreshed by 2026-10-06.
External reviews
- Lido gov — Kelp Incident Review (11579) · 2026-05-21
- Lido gov — Authorise loss coverage below 1% threshold (11527) · 2026-05-06
- Lido gov — Potential losses to EarnETH (11473) · 2026-04-23
- Aave gov — rsETH incident report (24580) · 2026-04-20
- Chainalysis — KelpDAO bridge exploit · OpenZeppelin — lessons from the Kelp hack · 2026-04
- Lido blog — EarnETH / EarnUSD launch · 2026-03-12 · product doc, not a risk rating
- Mellow — security & Core Vault audits · accessed 2026-07-06 — Nethermind EarnETH-specific report not located
- DeFiScan / LlamaRisk / Chaos Labs — no EarnETH review exists (checked 2026-07-06); the on-chain verification above is load-bearing until one does.