TL;DR
Scope first, because this file has two of them. It is titled Ether.fi and slugged ether.fi-liquid, and those name different products. DeFiLlama prices ether.fi-liquid at $283.29M and the Ether.fi parent at $3.5037B, a 12.4x gap. That gap is why this file was retitled on 2026-08-12: it is now Ether.fi Liquid, which matches the slug and matches the $283.29M we publish on the risk board, instead of implying a verdict on the $3.50B parent business. The eETH/weETH core is still covered here in full, because Liquid is built on ether.fi's infrastructure and inherits its staking layer, but the subject of the verdict is the vault product the slug names. Read the core sections as the foundation Liquid stands on, not as a rating of Ether.fi whole.
The core is in good shape and got better this window. Every admin claim in the docs survives an on-chain check: Upgrade Admin returns threshold 6 over 10 owners, the upgrade timelock returns exactly 864000 seconds, and the RoleRegistry that gates every privileged role is owned by that timelock. The oracle claims check out too, and this run they were read from the contracts rather than the docs: the rebase committee returns a quorum of 3 out of 3 members, and EtherFiAdmin returns a 500 bps acceptable rebase APR. Restaking is nearly gone. Under 1% of assets still sit with EigenLayer, headed to zero, so weETH is now plain Ethereum staking yield and EigenLayer slashing is not a live risk on it. The one live slashing condition is ordinary Ethereum consensus slashing, roughly 0.008 ETH per 32 ETH validator after Pectra, and no ether.fi validator has ever taken it.
What pulls this off solid is the layer the slug names, and it is worse than the docs let on. The Liquid vaults run on Veda's BoringVault stack. Read on-chain, the Liquid ETH vault, its accountant and its withdrawal queue have all renounced ownership and point at a single RolesAuthority; that RolesAuthority has no authority contract of its own, so under this pattern its owner is the only party who can assign roles at all. That owner is a 4-of-6 Safe with no timelock. Ether.fi's trust matrix opens by saying it covers eETH and weETH on Ethereum mainnet, and it does not cover this. Someone who reads the 10-day timelock story and then deposits into Liquid has bought a governance model they did not read about.
One question the last version left open is now answered, and the answer matters. The two layers do not share a Safe, but they do share a person. The address 0xe63794cf...05c9 is a signer on both ether.fi's Operating Admin and the Liquid Safe. Neither can reach the other's threshold alone, so this is not a shared admin in the control sense. It does mean the two governance sets are not the independent parties the separate addresses suggest.
Checklist
Audits & contracts. The public registry at github.com/etherfi-protocol/smart-contracts holds exactly 30 files, dated 2023-02-25 through 2026-06-28. Ether.fi's own docs describe this as "+30 reports from +10 independent security firms and audit programs"; the honest count is 30 files from nine named firms (Certora, CertiK, Decurity, Halborn, Nethermind, Omniscia, Paladin, Solidified, Zellic) plus the Hats Finance competitive audit from December 2023, which is the tenth entity and a program rather than a firm. Every one of those nine appears in the registry by name and date, so there are no invented auditors here, but seventeen of the thirty files are Certora, which is concentration worth knowing. The 26Q2 release, which shipped the consolidated RoleRegistry, the Blacklister, the RevokeAdmin contract and a rewritten withdrawal finalization, was reviewed by Certora in a report dated 2026-06-28, and the docs state three formally verified invariants: role membership changes only through the registry's guarded paths, the eETH exchange rate cannot decrease on user entry points, and the pool stays solvent for its withdrawal buffer. Immunefi bounty is live. The core is upgradeable proxies. Veda's BoringVault core contracts are not upgradeable, which moves the Liquid risk from code changes to role changes.
Admin control. Two layers, two very different answers, and this is the whole reason for the verdict.
For eETH and weETH, the documented story is real and I checked it rather than trusting it. Upgrade Admin is a 6-of-10 Safe at 0xcdd57D11...48c21, and getThreshold() returns 6 against 10 owners. The upgrade timelock at 0x9f26d4C9...20761 returns a getMinDelay() of 864000 seconds, which is 10 days to the second. The RoleRegistry at 0x62247D29...7cE9 returns that timelock as its owner(), so the path to any privileged role really does run through the delay. Operating Admin at 0x2aCA7102...8AdC is 4-of-7 with a 172800-second timelock, exactly 2 days, and can pause instantly. The stated boundary is that no key can move, redirect or seize user funds. Two powers deserve naming even though they are not seizure. A monitoring key can blacklist an address with an automatic 3-day expiry, and the Operating Admin can confirm, extend or make that permanent; ether.fi's trust matrix is specific that this "blocks transfers only" and "never burns, mints, or reassigns a balance," and that it is reversible by the same authority. Separately, a pending withdrawal claim can be invalidated, either through an oracle-committee report or by the Operating Admin behind its 2-day timelock, which "blocks a claim from paying out" and "never redirects the funds elsewhere." Neither burns a balance, but both can strand one. The Operating Admin that holds them is 6 internal signers out of 7, so ether.fi can reach the 4-signature threshold without any external party.
For Liquid, the control chain is short, undelayed, and verified end to end this run. Liquid ETH's BoringVault at 0xf0bb2086...416C has renounced owner() and delegates to a RolesAuthority at 0x485Bde66...8122. So have its accountant at 0x0d05D94a...8198 and its withdrawal queue at 0x0D2dF071...2cE0: both return owner() of zero and authority() of that same RolesAuthority. The RolesAuthority itself returns an authority() of zero, which in this pattern means no contract can call its role-setting functions and only its owner can. That owner is 0xcEA80390...ec96, a Gnosis Safe v1.3.0 with threshold 4 and 6 owners, on which getMinDelay() reverts, so it is not a TimelockController and no delay sits between it and a role change. Liquid USD's RolesAuthority at 0xaBA6bA1E...FF2e returns the same owner. That Safe is not merely the owner: getUserRoles() on both authorities returns the same bitmap, roles 5, 8, 9, 15 and 17, so it holds five live operational roles on top of ownership. Ether.fi's docs do describe this body in words, calling the merkle-root admin "a multi-sig from Veda and ether.fi teams," but they never publish its address, its threshold, or the fact that nothing delays it, and the trust matrix does not cover it. Which capabilities those five roles actually reach would require walking every capability assignment, which I did not do: treat the ceiling as unbounded until someone does.
Oracle. The core exchange rate is bounded twice and both bounds were read from the contracts. EtherFiOracle at 0x57AaF000...6a41 returns quorumSize() of 3 against numCommitteeMembers() of 3 and numActiveCommitteeMembers() of 3, so a rebase needs full consensus. EtherFiAdmin at 0x0EF8fa47...D705 returns acceptableRebaseAprInBps() of 500, a hard 5% APR cap that rejects anything over it, so a fully corrupt quorum still moves share value only about 1.37 bps per day. Note the flip side of full consensus: 3-of-3 has no liveness margin, and queued withdrawals finalize on oracle reports, so a stalled committee stalls finalization rather than mispricing anything. Committee changes go through the Upgrade Admin behind the 10 days. Liquid is priced separately, and its accountant is bounded as well: the Liquid ETH accountant returns an allowed upper change of 10050 and lower of 9950, meaning plus or minus 0.50% per update, with a 21600-second (6-hour) minimum delay between updates, not paused, a platform fee of 70 bps, and a rate of 1.1020560 last written 2026-08-12T02:51:23Z. Those bounds are real. They are also set by, and the updater role is granted by, the same 4-of-6 Safe with no delay, so read them as a constraint on the strategist rather than on the admin.
Liquidity & exit. weETH is trading at fair value, not at a discount. The on-chain redemption rate read at block 25738411 is 1.1013031 eETH per weETH; the market quote at the same time was 1.101829 ETH, a premium of 0.048%. The weETH premium over ETH is accrued yield on a non-rebasing wrapper, which is not a depeg. The exit path is a native queue plus instant redemption from rate-limited buckets, and it has a real stress result behind it: between 2026-04-18 and 2026-05-21, after the Kelp incident set off a market-wide redemption wave, ether.fi cleared 1,977 requests for 542,792 ETH, 19.6% of TVL, with a 4.9-day median to claimable, a 16.7-day worst case, and 100% claimable inside 17 days. Its worst single peg deviation through that window was minus 0.58% on 2026-04-20, and on-chain the market price tracked the internal redemption rate to within 0.12%. It funded the redemptions through Ethereum's consolidation queue rather than the exit queue, which is separately rate-limited, so it did not add to the shared line. Two caveats. weETH bridging was deprecated on eight smaller chains by 2026-06-30, so exit routes there are gone by design, and a publicly circulated Dune-based estimate held that roughly ten thousand holders had under 0.5 ETH on those chains and could be stranded by the two-month deadline; that figure is a critic's claim, not one I verified. And Liquid exit works differently: requests go to a queue with a minimum delay and a maximum fulfillment window, and are filled by Veda's solver, so an unfilled request expires rather than clearing. Current queue depth as of this pull is refresh.
Yield: real vs emission. Real, and simpler than it was. This is Ethereum staking yield in ETH, not inflationary token emissions. With EigenLayer exposure under 1% and winding to zero, weETH no longer carries a restaking reward component or the risk that came with it. Restaking moved to a separate Symbiotic-based token, weETHs, at roughly $17.7M and about 3.50% APY, and that one is not simple: a portion of collateral goes to Cap Protocol, M11 Credit borrows against it, and the proceeds land in a Pareto vault supplying FalconX's prime brokerage. Ether.fi's own docs list slashing, FalconX counterparty risk, M11 Credit default, smart-contract risk across Cap and Pareto, and liquidity risk as ways weETHs holders lose principal. Liquid yield is real strategy return, also at a different risk profile from staking.
Holder concentration. 95.87% of eETH is wrapped into weETH: 2,004,381.95 eETH exists, of which 1,921,588 ETH worth sits inside the weETH contract, leaving roughly 82,794 ETH unwrapped. That reconciles independently with the $158.38M eETH market cap, which is a good sign the supply figures are clean. It tells you the shape of the float but not who holds it. The token-level distribution pull failed again this run, with Etherscan's top-holders endpoint and Nansen's holders endpoint both returning Pro-subscription errors. This is the second month it has gone unmeasured, and it should stop being carried forward as a footnote.
Track record. Live since November 2023. No exploit of ether.fi's own contracts, no ether.fi validator ever slashed, and the largest redemption event in its history cleared without a missed withdrawal. Four things sit nearby and need stating so the clean record is not misread. The September 2024 event was an attempted takeover of the domain registrar account, blocked, no funds lost. On 2025-05-28 a third-party protocol, Cork, had its wstETH:weETH market exploited for about 3,760 wstETH, roughly $12M; that was Cork's contract, not ether.fi's. In April 2026 the Kelp rsETH cross-chain exploit, about $292M and the largest DeFi loss of the year, hit a different LRT; ether.fi stated its Liquid vaults had no exposure and paused LayerZero bridging for weETH and eETH as a precaution while the root cause was found. And in early August 2026 an aggregator published an "unverified" claim of a $6M ether.fi breach. It has no support: no primary source, no ether.fi confirmation, no auditor post-mortem, and the one page carrying it now returns HTTP 404. A separate and genuinely confirmed hack of about $6M hit Summer.fi on 2026-07-06, close enough in size and timing to be a plausible source of the confusion, but nothing establishes that link and I am not going to assert it. The honest statement is that the ether.fi claim is uncorroborated, not that it has been traced. Separately, eight Liquid vaults have been deprecated over time; no principal-loss event in any of them surfaced this run, but I did not audit their individual histories.
Worst case
Two of them, and they are not the same size.
On the core, a compromised or colluding 6-of-10 quorum queues a malicious upgrade. The 10-day delay is the backstop and it is verified, not asserted: the proposed code sits visible on-chain for 864000 seconds and every depositor can redeem first, with the admin getting no faster path. The narrower and more realistic core scenario is the Operating Admin, which is 6-of-7 internal, blacklisting an address or invalidating a pending withdrawal claim. That cannot take your ETH but it can stop you reaching it, and the only cure is the same multisig reversing itself.
On Liquid, the backstop does not exist. Four of six signers on a Safe that ether.fi's security docs never address can reassign roles across the vault, the accountant and the withdrawal queue immediately, because all three renounced their own ownership to an authority that answers only to that Safe. The merkle allowlist bounding the strategist and the plus or minus 0.50% accountant band are both downstream of it. Add the ordinary strategy risk on top: an integrated protocol failing takes vault capital with it, and the Cork exploit is the reminder that weETH-paired vaults elsewhere have already blown up. The shared signer does not let one layer control the other, but it does mean the "these are separate governance bodies" reading is too generous. Size Liquid separately from weETH and do not let one report's title merge them.
Slashing is the one risk that shrank. Ethereum consensus slashing costs roughly 0.008 ETH per 32 ETH validator post-Pectra, ether.fi spreads validators across eighteen named professional operators in ten-plus jurisdictions, and Nexus Mutual's ETH Slashing Umbrella Cover of up to 15,000 ETH is stated in the docs and was reported secured on 2026-07-17. No ETH is opted into a slashable EigenLayer service and policy says none will be. There is still no insurance fund for smart-contract loss.
Bottom line
Caution, and the reason is a boundary rather than a flaw in the staking product. Judged alone, eETH and weETH would rate solid: the admin story checks out on-chain end to end, both oracle bounds were read from the contracts this time instead of the docs, the exit path has absorbed a fifth of TVL in real conditions with a worst deviation under 60 bps, the token trades at NAV, and the scariest risk class in this cluster has been deliberately unwound to nearly zero. That is a better position than it was on 2026-07-01. But this report is titled for a business whose slug points at a vault layer of roughly $283M where the vault, the pricing contract and the withdrawal queue have all handed their keys to one authority owned by a 4-of-6 Safe with no timelock, uncovered by the trust matrix and sharing a signer with ether.fi's own Operating Admin. Worst-flaw-wins does not let a strong core carry a weaker sibling. Hold weETH on the core thesis. Treat Liquid as its own decision with its own size limit. And fix the slug, because the current one makes our scanner describe 8% of Ether.fi while the page says Ether.fi.
Data appendix
- TVL (scope split): Ether.fi parent $3.5037B; ether.fi Liquid $283.29M (the slug this file uses, 8.08% of the parent). Both orchestrator-verified from
api.llama.fion 2026-08-12. DeFiLlama TVL is a live figure denominated largely in ETH: same-day re-pulls a few hours later returned $286.71M and $3.5667B, so treat these as a range, not a fixed point. The parent has four children: ether.fi Stake, ether.fi Liquid, EtherFi Borrowing Market and EtherFi Cash Liquid, which summed to $3.8686B against a parent of $3.5667B on the same pull, so roughly $300M is netted out; DeFiLlama's exact netting rule is refresh. On-chain cross-check: eETH totalSupply 2,004,381.95, worth about $3.8267B at $1,909.18/ETH, roughly 15% above DeFiLlama's Stake figure. - Peg: weETH on-chain rate 1.1013031 eETH/weETH at block 25738411; market 1.101829 ETH (CoinGecko live), a +0.048% premium, so at NAV. eETH 1.000936 ETH. weETH market cap $3.6707B; weETH totalSupply 1,744,831.22. Worst intraday deviation across 2026-07-01 to 2026-08-12 is refresh: CoinGecko's ETH-denominated daily series is internally inconsistent and cannot support the claim. The best documented figure is from the April stress window, minus 0.58% on 2026-04-20, with market price tracking the internal redemption rate to within 0.12%.
- Audits: the GitHub registry contains exactly 30 files dated 2023-02-25 to 2026-06-28, seventeen of them Certora, at github.com/etherfi-protocol/smart-contracts/tree/master/audits. Nine firms named and all nine verified present: Certora, CertiK, Decurity, Halborn, Nethermind, Omniscia, Paladin, Solidified, Zellic, plus a Hats Finance competitive audit dated 2023-12-20. Ether.fi's docs phrase this as "+30 reports from +10 independent security firms and audit programs". Latest major review: "2026.06.28 - Certora - 26Q2 Security Upgrade.pdf", with three invariants stated as formally verified. Immunefi bounty live.
- Admin/governance (core, all verified on-chain this run): Upgrade Admin Safe
0xcdd57D11476c22d265722F68390b036f3DA48c21,getThreshold()=6, 10 owners. Upgrade Timelock0x9f26d4C958fD811A1F59B01B86Be7dFFc9d20761,getMinDelay()=864000s (10 days). RoleRegistry0x62247D29B4B9BECf4BB73E0c722cf6445cfC7cE9,owner()= that timelock. Operating Admin Safe0x2aCA71020De61bb532008049e1Bd41E451aE8AdC,getThreshold()=4, 7 owners (6 internal, 1 external per docs). Operating Timelock0xcD425f44758a08BaAB3C4908f3e3dE5776e45d7a,getMinDelay()=172800s (2 days). One address,0xde3bf1fa...8264, signs both core Safes. Other named contracts, all confirmed to hold code: Blacklister0x5585996E7cFE95f2D99e61168B8b35C66Ff99B18, RevokeAdmin0x4A84BA0b5e716b37C78D0F5094757205626C7C1e, EtherFiAdmin0x0EF8fa4760Db8f5Cd4d993f3e3416f30f942D705, monitoring pause-only key0x9af1298993dc1f397973c62a5d47a284cf76844d, LiquidityPool0x308861A430be4cce5502d0A12724771Fc6DaF216. - Admin/governance (Liquid, verified on-chain this run, not covered by ether.fi's trust matrix): Liquid ETH BoringVault
0xf0bb20865277aBd641a307eCe5Ee04E79073416C,owner()=0x0,authority()=0x485Bde66Bb668a51f2372E34e45B1c6226798122. Liquid ETH Accountant0x0d05D94a5F1E76C18fbeB7A13d17C8a314088198and BoringOnChainQueue0x0D2dF071207E18Ca8638b4f04E98c53155eC2cE0: bothowner()=0x0 andauthority()= the same RolesAuthority. Liquid USD RolesAuthority0xaBA6bA1E95E0926a6A6b917FE4E2f19ceaE4FF2e. Both RolesAuthority contracts returnauthority()=0x0 andowner()=0xcEA8039076E35a825854c5C2f85659430b06ec96, a Safe v1.3.0 withgetThreshold()=4 and 6 owners, on whichgetMinDelay()reverts.getUserRoles(Safe)on both authorities returns 0x28320, that is roles 5, 8, 9, 15 and 17. Signer overlap:0xe63794cf405678382764a4dec1e56c43b45605c9is an owner of both this Safe (1 of 6) and ether.fi's Operating Admin (1 of 7); there is no overlap with the Upgrade Admin. Ether.fi's docs call the merkle-root admin "a multi-sig from Veda and ether.fi teams" without publishing address, threshold or delay. Six live Liquid vaults (ETH, USD, BTC, Reserve, RWA, Euro); platform fee stated as 0% to 2% with no performance fee, and the Liquid ETH accountant returns 70 bps. - Oracle: EtherFiOracle
0x57AaF0004C716388B21795431CD7D5f9D3Bb6a41:quorumSize()=3,numCommitteeMembers()=3,numActiveCommitteeMembers()=3, so full consensus (it was 2-of-3 at the July report). EtherFiAdmin0x0EF8fa4760Db8f5Cd4d993f3e3416f30f942D705:acceptableRebaseAprInBps()=500, about 1.37 bps/day, and itsroleRegistry()points at the core RoleRegistry. Liquid ETH AccountantaccountantState(): upper 10050 / lower 9950 (plus or minus 0.50% per update),minimumUpdateDelayInSeconds=21600 (6h),isPaused=false, exchangeRate 1.1020560, last update 2026-08-12T02:51:23Z, 105,543.76 shares outstanding, about 116,315 ETH. Identity of the accountant's rate-updater role holder: refresh. - Cross-chain (the Kelp question): ether.fi's trust matrix states every weETH bridge message must clear a full 4-of-4 quorum of independent verifier networks (Canary, Horizen, Nethermind, LayerZero Labs). That is the opposite of the 1-of-1 verifier that let Kelp's April 2026 bridge mint about $292M of unbacked rsETH. Bridging was deprecated on Scroll, Swell, Bera, zkSync, Mode, Blast, Morph and Sonic by 2026-06-30. Per-lane on-chain confirmation of the DVN set: refresh.
- Restaking / slashing: docs state "less than 1% of ether.fi's assets remain restaked with EigenLayer", 0% targeted in Q3 2026, EigenPod credentials removed in Q4 2026, and "no restaking slashing risk today" because nothing is enrolled in a slashable service. Ethereum validator slashing about 0.008 ETH per 32 ETH validator post-Pectra; never triggered on an ether.fi validator. Nexus Mutual ETH Slashing Umbrella Cover up to 15,000 ETH, reported secured 2026-07-17; the live cover terms were not read from Nexus Mutual.
- Node operators: eighteen named operators (Galaxy Digital, Luganodes, Stakefish, Validation Cloud, InfStones, Node Monster, Allnodes, HashKey Cloud, P2P.org, Chainnodes, eBunker, DSRV, Nethermind/Twinstake, Finoa, Cosmostation, MAVAN/Pier Two, Stakin, Blockdaemon) across the USA, Switzerland, BVI, Israel, Hong Kong, Cayman Islands, UK, South Korea, Germany, Estonia and Australia, with per-operator ISO 27001 and SOC 2 status published. Per-operator validator share, the number that would actually quantify concentration, is not published: refresh.
- Withdrawals: 2026-04-18 to 2026-05-21, 1,977 requests, 542,792 ETH redeemed (19.6% of TVL), median 4.9 days to claimable, longest 16.7 days, 100% inside 17 days, funded via Ethereum's consolidation queue, which is rate-limited separately from the exit queue. Liquid queue depth on 2026-08-12: refresh.
- Holder concentration: refresh. Etherscan
tokenTopHoldersand Nansentoken_current_top_holdersboth returned Pro-subscription errors this run. Known: weETH supply 1,744,831.22 (about 1,921,588 ETH), 95.87% of all eETH, leaving about 82,794 ETH unwrapped, which reconciles with the $158.38M eETH market cap to within 0.2%. - Recent-news / incident scan (2026-06-01 to 2026-08-12): ether.fi blog posts confirmed by title and date: 2026-06-09 "How ether.fi Redeemed 20% of TVL Without Adding a Day to Ethereum's Exit Queue"; 2026-06-23 "Non-custodial, actively defended"; 2026-07-14 "Safe Staking, From Doctrine to Code", which is also where the claim of weETH's "first independent A+ risk rating in liquid restaking" originates (the rating document itself was not read, refresh); 2026-07-22 "Why KPK made weETH a core holding"; 2026-08-06 "Hardening weETH, creating the market standard", a three-phase security programme alongside new 86% LTV weETH borrow markets on SteakhouseFi Prime Morpho vaults. August 2026: restaking formally removed from weETH and split into the Symbiotic-based weETHs, roughly $17.7M at about 3.50% APY. Early August 2026: an aggregator ran an "unverified" $6M ether.fi breach claim with no primary source and no ether.fi confirmation; its page now returns HTTP 404. A confirmed and unrelated $6M hack hit Summer.fi on 2026-07-06. No confirmed ether.fi incident in this window. Maintained monthly. Methodology: DeFi Research Instruction v2.