ether.fi weETH

under-reviewethereumreviewed 2026-08-06

TL;DR

How it works

Deposit ETH, receive rebasing eETH; weETH wraps it non-rebasing (rate 1.100877). Pooled ETH goes to permissioned DVT operators (SSV/Obol) whose withdrawal credentials point at EtherFiNodes owning EigenPods. A 2026-07-14 upgrade rebuilt the permission model (Risks #3–#4).

Oracle: NAV comes from ether.fi’s own protocol keys, now 3-of-3 unanimous — the documented 3-of-5 shipped 2026-07-27, then two members were cut next day. Reports rebase eETH, capped at 5% annualized, and gate withdrawal finalization. Aave prices weETH off the capped internal rate (CAPO 0x8762…6d4C), not market, so nothing here liquidates.

Yield — the wstETH switch question: gross ~2.8% (ether.fi) is base staking, an MEV-passive premium split 90/5/5 (docs). Realized net, against wstETH over identical windows:

WindowweETHwstETHSpread
30d2.48%2.22%+26 bps
90d2.47%2.36%+11 bps
180d2.47%2.42%+5 bps
1 year2.52%2.55%−2 bps

No yield case for rotating wstETH into weETH: the spread inverts at a year, the lead changed hands 52 times at a median regime of 3 days, and part of the recent excess is a redemption transfer that fades (study). Carry is network-wide, so it doesn’t compress as TVL grows.

Label vs exposure: marketed as a restaking token, weETH is a plain ETH LST — 65% of supply sits in Aave v3 alone, 72% across all lending venues.

Risks

Verified on-chain (2026-08-06, block 25695733): supplies, rate + realized APY, a 211-day daily series of pooled ETH and buffer, 10d timelock + 6/10 Safe composition + the new 4/6 canceller, both pause paths (pause() 4/7-gated, pauseUntil() guardian-gated — call-traced), 3-of-3 oracle quorum + committee history + 5% rebase cap, restaked share (~19,000 ETH; per-pod census method-sensitive, not claimed), Aave share/caps/eMode/CAPO source, buffer watermark + instant-path cap, Curve depth, queue depth, Aave-share history and the levered/unlevered split, EigenLayer 14d escrow. Apr-2026 DEX marks reproduced from dex.trades during review. Taken on trust: no-slashable-AVS policy + 90/5/5 fee split + 15,000 ETH Nexus Mutual cover + SSV/Obol as the DVT vendors (docs).

IDRiskMechanismSource + our delta
R1Reflexive Aave concentration → congested exit at a discount1,126,310 weETH (65% of supply, up from 61%) in Aave v3 Ethereum — 77.5% base LTV, eMode loopers at 93/95, cap 92% used. Sector shock → deleveraging into one queue. Exit: peg <−1% for 24h, or queue median >7d.Gauntlet (2024-12) modeled ~7× amplification via Aave loops, though on a slash-triggered premise that barely applies at <1% restaked. LlamaRisk raised the cap 2026-07-22 citing minimal liquidation risk; we add the measured mechanism: the Aave leg fell 2,032,432 → 1,126,310 weETH since 2026-03-23, supplying the bulk of the supply contraction. Its share of supply already deleveraged once — 79% down to 60% — and is now re-levering into a 92%-used cap.
R2Instant-exit lane is structurally thinInstant redemption shuts below a 1%-of-TVL buffer watermark, refilling 2,000 ETH/day when open. The buffer sat below it on 103 of 211 days (median 1.05%); today 6,788 ETH, 0.34%, shut since 2026-07-30. Exit: buffer <5,000 ETH for 24h.Our on-chain measurement; in no external report and absent from our prior assessment, which described the instant path as available and missed the daily cap. This is the design’s normal state, not distress — but it means the fast lane cannot be assumed present.
R3Oracle liveness under a unanimous quorum3-of-3 committee publishes beacon balances; one silent key stalls reports, and reports gate withdrawal finalization. Raising the quorum hardened NAV integrity and weakened liveness in the same move. Exit: no oracle report >24h, or unexplained committee change.LlamaRisk (2024-06) flagged quorum-1; long obsolete. Ours: 3-of-5 on 2026-07-27, contracted to 3-of-3 within 30 hours — an unexplained committee change, i.e. this row’s own exit trigger, unresolved. Reports currently flowing.
R4Upgrade-key compromiseweETH/eETH/LiquidityPool are UUPS proxies owned by a 10-day timelock (0x9f26…0761); a 6/10 Safe (9 bare EOAs + one 2/7 Safe) is sole proposer/executor. Hostile 6/10 → drain after 10d. Exit: any unexpected timelock queue tx.LlamaRisk (2024-06) flagged 2/6 and no timelock — obsolete. We add: since 2026-07-14 an independent 4/6 Safe holds CANCELLER_ROLE (one shared signer), making the delay a vetoable window. Bounty $500k (2026-08-06), thin against $3.78B.
R5Consensus slashing, socializedPermissioned operators post no bonds; an ordinary slash (~0.008 ETH/validator post-Pectra) rebases across all holders, above a stated 15,000 ETH Nexus Mutual cover. Never slashed to date (on trust).LlamaRisk (2025-04): Pectra cut the initial slash penalty ~128×; we agree it’s a tail, not a driver.
R6Restaking risk re-expansion”No slashable AVS” is policy, not code, and nothing stops the sleeve being rebuilt. Today it is under 1% of the pool, so live exposure is negligible. Re-evaluate: restaked share rising, or any slashable opt-in.Docs (2026-08-06) commit to 0% restaked by Q3 2026 and EigenPod credentials removed by Q4 2026, and state “less than 1%” remains — our independent read agrees (~19,000 ETH; the per-pod census is method-sensitive, so we cite the ETH figure only). No mainnet slashing incident to date.

Key-compromise threshold

Liquidity & exit

Primary: queue at NAV — no fee, but a claim pays the lesser of request-time ETH and share value, so in-queue yield is forfeited. Near-empty today (nextRequestId − lastFinalizedRequestId = 9) and tested hard: it cleared 415,141 ETH in one week (59,306 ETH/day). Instant: RedemptionManager at 30bps, but totalRedeemableAmount = 0 — the buffer is under the 1%-of-TVL watermark, refilling 2,000 ETH/day. DEX: Curve fills 1,000 weETH at −0.03%, 2,000 at −0.67%; at size the queue is the only exit.

Defensible size: $50M (23,922 weETH ≈ 26,335 ETH, 1.33% of the pool) — half a day of demonstrated stressed throughput. The rubric haircut takes the worse of 3× today’s slippage (−0.08%) and the worst comparable stress mark: Apr-2026’s −0.82% daily VWAP / −1.47% worst hour binds. No DEX haircut is quotable here: the cost is time plus ~−0.8%.

Stress scenario: exiting 50% ($25M) in 7d queues entirely; the spring run cleared 31× that in a week, though under a 2-of-3 oracle and a larger pool.

Retention: deposits sit 41.8% below the January peak, and the outflow was disproportionately levered — the Aave leg shrank 44.6%. Whether the rest is durable spot is unsettled; our residual nets Aave only. Study.

External reviews