Skip to content
PROTOCOL RESEARCH

Ether.fi risk

The largest liquid restaking token, deeply audited with a 10-day upgrade timelock and an onchain rule that no key can seize user funds; core staking risk is low, with yellows on the upgradeable admin and the actively-managed Liquid vaults. The native withdrawal queue absorbed a ~20%-of-assets redemption wave in April 2026 without breaking peg.
SolidResearched Jul 1, 2026

Scorecard

strong: Audits & contracts30+ public reports since Feb 2023 from 10+ firms (Certora, CertiK, Zellic, Nethermind, Halborn, Decurity, Omniscia, Paladin, Solidified), Immunefi bounty, Hats competitive audit Dec 2023; all named firms verified in the public GitHub registry. Contracts are upgradeable proxies.
watch: Admin controlUpgrade Admin 6-of-10 Safe behind a 10-day timelock; Operating Admin 4-of-7 with instant pause and 2-day parameter timelock; docs state no key or multisig can move or seize user funds, but proxies are upgradeable.
strong: OracleEtherFiOracle 2-of-3 rebase committee (target 3-of-5 by end July 2026), every report bounded by an onchain 5% APR cap that auto-rejects over-cap reports (roughly 1.37 bps/day ceiling).
strong: Liquidity & exiteETH ~1.00 ETH, weETH ~1.10 ETH (accrued yield, not a depeg); native withdrawal queue held during the Apr-2026 redemption wave (~542.8k ETH, ~19.6% of assets, over a month) with deep secondary DEX/L2 liquidity.
strong: Yield (real vs emission)Yield is real ETH staking plus restaking rewards, not token emissions; Liquid vault yield comes from actively managed DeFi strategies (a distinct, higher risk profile).
watch: Holder concentrationweETH ~$2.88B mcap is widely held across DeFi, but a token-level distribution/whale-exit check was not completed this run (_refresh_).
strong: Track recordLive since Nov 2023, no exploit of ether.fi's own contracts; no validator ever slashed; Sep-2024 domain-registrar takeover attempt blocked with no fund loss. Note: a third-party Cork Protocol vault paired against weETH was exploited May-2025 (not an ether.fi contract), and ether.fi's own Liquid vaults were confirmed unaffected by the Apr-2026 Kelp/rsETH incident.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$283.1M
30d↑18%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

Ether.fi is the biggest liquid restaking token: deposit ETH, get eETH (rebasing) or weETH (wrapped), earn staking plus restaking rewards. The contracts are upgradeable proxies, so the central question is admin risk, and here the answer is unusually good. Upgrades run through a 6-of-10 multisig behind a 10-day timelock, and the docs state plainly, verifiable onchain, that no key or multisig can move or seize user funds. Powers are limited to upgrading code slowly, tweaking parameters, and pausing. Two things earn a yellow: the proxies are upgradeable at all (mitigated by the timelock, which lets you exit before a change lands), and the Liquid vaults are actively managed strategies that carry more smart-contract and strategy risk than plain staking. Restaking slashing, the scary new risk class, is close to zero today because ether.fi has not opted its ETH into any slashable service.

Checklist

Audits & contracts. More than 30 public reports since February 2023 from 10-plus firms. Nine are named and every one is verified present in the public GitHub audit registry: CertiK (Feb 2023), Omniscia, Nethermind, Solidified, Zellic, Decurity, Halborn, Paladin, and Certora (the most frequent auditor, with reports running into 2026 covering Pectra features and queue mechanics). There is a live Immunefi bug bounty and a Hats Finance competitive audit from December 2023. Contracts are upgradeable proxies, not immutable. Admin control. Upgrade Admin is a 6-of-10 Safe (3 internal, 7 external) routed through a 10-day timelock on every action, including changing its own delay. Operating Admin is 4-of-7 with instant emergency pause and a 2-day parameter timelock. The stated, checkable boundary: neither can touch user balances. Oracle. weETH's exchange rate updates via an EtherFiOracle committee, 2-of-3 today (target 3-of-5 by end July 2026). Every rebase passes an onchain 5% APR cap; over-cap reports are auto-rejected, so even a fully fraudulent quorum can only move share value a small bounded amount per report (roughly 1.37 bps/day). Liquidity & exit. eETH trades at about 1.00 ETH and weETH at about 1.10 ETH; the weETH premium is accrued yield on a non-rebasing wrapper, not a depeg. Redemption is a native withdrawal queue back to ETH, backed by deep secondary liquidity on major DEXes and L2s. That queue got a real stress test: after the April 2026 Kelp/rsETH incident, ether.fi processed roughly 542,800 ETH of withdrawals (about 19.6% of assets) over the following month without breaking peg. Yield: real vs emission. Real. It is Ethereum staking yield plus EigenLayer restaking rewards, denominated in ETH, not inflationary token emissions. Liquid vault yield is real too but sourced from actively managed DeFi strategies, which is a different risk profile. Holder concentration. weETH's roughly 2.88B dollar market cap is spread widely across DeFi (lending markets, Pendle, LPs). A token-level whale/distribution pull was not completed this run; treat as refresh. Track record. Live since November 2023 with no exploit of ether.fi's own contracts, and no ether.fi validator has ever been slashed. Two nearby events are worth stating honestly so the clean-record framing is not misread. First, the September 2024 incident was an attempted takeover of the domain registrar account (Gandi), blocked within hours with no fund loss and no compromised dapp. Second, on weETH-adjacent surfaces: a third-party protocol (Cork) had a wstETH:weETH liquidity vault exploited in May 2025 for about 3,761 wstETH, which was Cork's contract and automation failing, not ether.fi's; and the April 2026 Kelp/rsETH cross-chain exploit hit a different LRT, with ether.fi confirming its own Liquid vaults were unaffected. Neither was a loss in ether.fi's core staking contracts.

Worst case

A compromised or colluding Upgrade Admin quorum pushes a malicious upgrade. The 10-day timelock is the backstop: the proposed code is visible onchain for 10 days and any depositor can exit to ETH first, on the same footing as everyone else. A separate tail risk is the Liquid vaults, where a strategy or integrated-protocol failure could lose vault capital independent of the core staking contracts (the May-2025 Cork exploit is the cautionary example of a weETH-paired third-party vault blowing up), so size those separately. On restaking, the maximum validator slashing is about 0.008 ETH per 32 ETH validator post-Pectra, and no ETH is opted into a slashable AVS today, so restaking slashing is effectively zero unless that policy changes. There is no protocol insurance fund covering smart-contract loss; slashing insurance is described as TBD.

Bottom line

Solid for the core eETH/weETH staking product. The admin surface is upgradeable but well-fenced by a real 10-day timelock and an onchain no-seize guarantee, the oracle is double-bounded, and the native withdrawal queue has now demonstrably absorbed a ~20%-of-assets redemption wave without a depeg. The honest cautions are the two yellows: upgradeable proxies (accept the timelock, size accordingly) and the actively-managed Liquid vaults (a distinct, higher risk you should not treat as equal to plain staking, and the surface where the one real weETH-adjacent exploit landed, on a third party). No fund-loss deal-breaker in ether.fi's own contracts.

Data appendix

  • TVL: ~$2.89B (DeFiLlama "ether.fi", 2026-07-01, input-verified at $2.888B). weETH market cap ~$2.88B corroborates.
  • Peg: eETH 1.0036 ETH, weETH 1.0993 ETH (CoinGecko live, 2026-07-01). weETH premium is accrued yield, not a depeg.
  • Audits: 30+ reports since Feb 2023, 10+ firms; all nine named firms (CertiK, Omniscia, Nethermind, Solidified, Zellic, Decurity, Halborn, Paladin, Certora) verified present in registry github.com/etherfi-protocol/smart-contracts/tree/master/audits; live Immunefi bounty; Hats competitive audit Dec 2023 (ether.fi docs, Security & Risks / Audits).
  • Admin/governance: Upgrade Admin 6-of-10 Safe (0xcdd57D11...48c21) behind a 10-day timelock (0x9f26d4C9...20761); Operating Admin 4-of-7 Safe (0x2aCA7102...8AdC) behind a 2-day timelock (0xcD425f44...45d7a) with instant pause; no key can move/seize funds (ether.fi docs, MultiSigs & Controls; addresses verifiable on Etherscan).
  • Oracle: EtherFiOracle 2-of-3 (target 3-of-5 by end Jul 2026), contract 0x57AaF000...Bb6a41; onchain 5% APR rebase cap, over-cap auto-reject (ether.fi docs).
  • Restaking/slashing: No validator ever slashed; no ETH opted into slashable AVS (policy); restaked share falling from ~50% early 2026 to <20% by Q3 2026; validator slash ~0.008 ETH/32 ETH post-Pectra (ether.fi docs, Slashing Risk).
  • Holder concentration: refresh (token-level whale/distribution pull not completed this session).
  • Recent-news / incident scan: Sep-2024 domain-registrar takeover attempt, blocked, no fund loss (ether.fi docs). Third-party Cork Protocol wstETH:weETH vault exploit ~3,761 wstETH, May 2025 (Cork post-mortem; not an ether.fi contract). Apr-2026 Kelp/rsETH cross-chain exploit hit a different LRT; ether.fi Liquid vaults confirmed unaffected and processed ~542.8k ETH (~19.6% of assets) of withdrawals over the following month without a depeg (ether.fi / press). Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols