TL;DR
Puffer is native liquid restaking on EigenLayer. You deposit ETH, you get pufETH, an ERC4626 share worth 1.0817 ETH today. The contract code is not the problem here: seven audit firms have been through it, Trail of Bits and Nethermind among them, and I found no protocol-level exploit in roughly two and a half years of operation.
Three other things decide the risk. First, a 3-of-6 multisig can call any contract with no delay at all. That is not a rumor about the design, it is the deployed bytecode: the Timelock's executeTransaction returns early for COMMUNITY_MULTISIG before it ever looks at the queue, above a comment reading "Community multisig has 0 delay". The 7-day timelock binds only the operations multisig. Second, one unlabeled wallet holds 50.26% of all pufETH. Not a contract, not a custodian with a public tag, an ordinary externally owned account that minted half the supply between February and March 2026. Third, the book has fallen from $1.84B at peak to $45.97M, 97.87% of it is staked, and the vault's liquid buffer is 514 ETH.
The anti-slashing hardware that Puffer is known for does not appear to be a live requirement on node operators, and I could not confirm it is enforced anywhere today.
Checklist
Audits & contracts. BlockSec (v1 and v2), SlowMist (v1 and v2), Quantstamp, Immunefi Boost, Trail of Bits, Nethermind and Creed, all listed in Puffer's own pufETH repository. I checked the links rather than trusting the list: the Trail of Bits report resolves inside the trailofbits/publications repo and the Nethermind report inside NethermindEth/PublicAuditReports, which is confirmation from the auditors' own side rather than the client's. The BlockSec and Creed April 2024 reports resolve too, and the repo's audits/ directory holds six PDFs including one from 0xLuckyLuke that the README never mentions. That is a genuinely deep roster for a protocol this size and it is the strongest thing on this scorecard.
Three caveats, none fatal. SlowMist v2 is listed as text with no link behind it, so that one report is asserted and not shown. Every Immunefi URL for Puffer now returns 404, so the Boost competition was a one-time 2024 engagement and I found no evidence of a live bug bounty today. And pufETH is an ERC1967 proxy currently pointing at implementation 0x3b2fdfde..., which Puffer's deployments repo pins to a source commit but which I could not tie to any specific audit report. The audits are real. Their currency against the live code is refresh.
Admin control. This is the first red, and it is confirmed at the bytecode level rather than inferred. The pufETH vault is upgradeable, its authority() is the AccessManager at 0x8c168606..., and the Timelock is ADMIN_ROLE on that AccessManager. I checked the upgrade path directly: canCall(Timelock, pufETH, upgradeToAndCall) returns true with zero execution delay.
Puffer documents three multisigs and my on-chain reads match the docs exactly: operations is 3-of-6 behind a 604,801 second delay (7 days and one second), community is 3-of-6 with no delay whatsoever, and the pauser is 1-of-9. The Timelock's constructor arguments name the community multisig in first position, so the address holding the zero-delay path is not in doubt. The community multisig exists as a check on the operations multisig and its members are described as outside community figures and auditing firms, which is the mitigating half of the story. The other half is that the code grants it an unrestricted target.call(callData). Three keys can replace the vault implementation in a single transaction.
Two details the docs do not spell out. One address, 0xd70aa9d7..., sits on both the community and the operations multisig, so the two sets are not fully independent. And all six community signers also sit on the 9-owner pauser Safe, which has a threshold of 1, meaning any one of them can freeze the protocol alone. Pausing protects depositors more often than it hurts them, but it is a single-key power over your ability to transact.
On the node operator side there is no whitelist to control. Puffer's docs are explicit that "anyone can become a Puffer NoOp because our protocol is permissionless". The real gate sits one layer over: Guardians vet each registration before provisioning 32 ETH and can skip invalid ones, and restaking operator participation is separately restricted. So operator entry is permissionless in form and Guardian-gated in practice.
Oracle. There is no price oracle in the usual sense, and that is the point worth understanding. The pufETH conversion rate is not read from Chainlink or a TWAP. It comes out of on-chain accounting that a permissioned group called the Guardians updates when validators exit, a design Puffer calls lazy proof of reserves. The docs describe the Guardians as "a group of trusted and permissioned nodes" and say a majority is required, giving "7 out of 8" as an example rather than a specification. I did not verify the guardian set or its threshold on chain. So the number your position is marked at depends on a small permissioned committee behaving honestly. That is defensible for native staking and it is not unusual, but it is a trust assumption, not a market price.
Liquidity and exit. The second red, and it is measured, not estimated. The vault holds 514.44 ETH against 24,098.79 ETH of total assets, a 2.13% buffer. That is essentially all native ETH: the vault's WETH balance is zero and its stETH balance is 0.38. Instant exit costs a 1% fee and runs until that buffer is gone, call it $982k of capacity. After that you are in the two step queue: around 14 days, and it only clears when Guardians eject validators, 32 ETH at a time, and a Puffer backend processes the batch.
The secondary market is the part worth correcting carefully. There are four pufETH pools, not three, and DexScreener indexes only three of them. A second Curve pufETH/wstETH pool at 0xb3c8ce1e... holds 1,020.12 pufETH that the aggregators miss, which brings pufETH sitting in pools to 1,441.24, or 6.47% of supply. That sounds better than the aggregator view until you look at which side of each pool holds what. That missed pool holds 1,020 pufETH against just 36 wstETH, meaning its exit side has already been drained. Across all four pools the buy-side depth, the WETH and wstETH someone would actually hand you for your pufETH, totals about 610 ETH. Daily volume across all of them is roughly $2.2k, which is thinner than it sounds even for a $46M protocol.
Add it up honestly: 514 ETH of vault buffer plus about 610 ETH of DEX depth is roughly 1,125 ETH, under 5% of the book, available without waiting. A 2% buffer is normal for a staking protocol and I am not calling it an anomaly on its own. The problem is that the secondary market which normally serves as the escape hatch is the same order of magnitude as the buffer, so both exits are narrow at once. The peg itself is fine: pufETH trades between 1.0776 and 1.0807 ETH depending on venue against a 1.081729 NAV, a discount of 0.1% to 0.4%.
Yield: real vs emission. Green, and it is real. pufETH accrues from proof of stake rewards, restaking fees and validator ticket sales, not from PUFFER emissions. Worth noting how this differs from a conventional LRT: Puffer decouples depositor return from its own validators' PoS performance, because node operators keep the consensus and execution rewards and instead pre-pay for the right to validate by burning validator tickets. Depositors are buying that ticket revenue plus restaking rewards. It is a different accrual path, not a better or worse one. The implied rate since inception is about 3.2% a year, consistent with real staking yield and not with subsidy.
One risk that belongs here rather than in a footnote. The node operator bond is 2 ETH, and Puffer's own slashing page notes that PoS slashing penalties range from 1 to 32 ETH. The operator forfeits their entire bond when slashed, but any penalty above 2 ETH lands on the vault, which means on you. Puffer's docs still say withdrawing consensus rewards is temporarily disabled because EigenLayer partial withdrawal proofs are cost prohibitive, and I confirmed that line is still published today rather than assuming it was stale.
Holder concentration. This is the third red, and it is the finding that changed most in this review. Etherscan and Nansen both gate their holder endpoints behind Pro, but a free provider returns the list, and I did not take its word for it: I re-read the top balances directly with balanceOf against a public node, and the numbers match to the cent, including a Curve pool balance that agrees exactly with what DexScreener reports for the same pool.
A single address, 0xd5549b9e..., holds 11,196.79 pufETH. That is 50.26% of supply, a claim on roughly 12,112 ETH, or 23.5 times the entire liquid buffer. It has no code, so it is an ordinary wallet rather than a contract or a Safe, it carries no public label, and it holds 0.1 ETH and a scattering of dust tokens alongside its half of the protocol. Its history is short: a 0.93 pufETH test mint on 2026-02-25, a 9,907.71 mint the next day, then on 2026-03-25 it moved that balance to another address and minted the current 11,196.79. The top fifteen addresses hold about 85% of supply between them, and one of those slots is Puffer's own protocol contract holding 1,417.90 pufETH of node operator bonds, which is locked collateral rather than float.
The timing sits close to Puffer's Anchorage Digital custody launch on 2026-03-12, and an institutional custody omnibus would be a perfectly benign explanation. I want to be clear that I could not confirm that, and I am not asserting it. What is established is the shape of the risk: half this protocol belongs to one party whose identity, intentions and redemption schedule are unknown to you, sitting in front of a 514 ETH buffer.
Track record. Live since February 2024. Zero Puffer entries across all 621 records in DefiLlama's hacks list, and no exploit, depeg or slashing event surfaced in news scans. That is a real clean record and it counts. Against it: TVL is down 97.5% from the June 2024 peak, down 28.1% over 90 days and down 75.1% year over year, while PUFFER trades at $0.0126 against a $0.99 all-time high with a $6.4M market cap. For scale, the 2024 Series A was a SAFT at a $200M token valuation; the fully diluted value today is $12.6M, down about 94% from where professional investors marked it. The team has been shipping, mostly toward institutional custody and preconfirmations rather than the restaking book. A shrinking franchise is not a hack, but it raises the odds that attention and maintenance drift, and the risk you are underwriting is a permissioned one that depends on people continuing to pay attention.
Worst case
Three of the six community multisig keys are compromised. The attacker calls executeTransaction, points the vault proxy at a malicious implementation, and drains 24,098 ETH. There is no delay to detect it in, no queue to watch, and no authority sitting above that multisig to veto it. The 7-day timelock protects you from the operations multisig and from nothing else.
The slower version needs no attacker and no coordination, just one decision by one wallet. The 50% holder redeems. Their 12,112 ETH claim empties the 514 ETH buffer in the first transaction and puts everyone behind them in a queue that clears only as Guardians eject validators 32 ETH at a time. About 610 ETH of DEX depth will not absorb the overflow, and the pools would gap well before it did. You would likely still get paid, because the assets exist and the accounting is honest, but on the protocol's schedule rather than yours, and you would be standing behind the largest holder in the line rather than in front of them.
Bottom line
Caution, which confirms the prior verdict from 2026-07-01, though for sharper and more numerous reasons than before. Worst flaw wins, and there are now three reds across surfaces that can cost you principal or the ability to reach it. What keeps this out of avoid: the admin and liquidity weaknesses are openly documented by Puffer rather than hidden, the multisig paths are threshold gated, seven audit firms have reviewed the code with two reports independently hosted by the auditors themselves, the peg holds within 0.4% of NAV, the vault's on-chain assets reconcile with reported TVL to within 0.1%, and nothing in two and a half years suggests the keys have been misused.
Size it as a trust position, not a code position. At $10k scale the 1% instant exit works, the queue never matters, and the concentration is somebody else's problem. At size, or in a stress window, none of that holds, and the order of the queue is decided by a wallet you cannot identify. If a three key instant upgrade path over your principal is something you cannot accept, then this is an avoid for you specifically, and that is a reasonable place to land.
One correction to the protocol's own reputation, since it is the thing Puffer is best known for. The Secure-Signer and RAVe anti-slashing story does not appear to describe what is required of node operators today. The current requirements page lists a 2 ETH bond, at least 28 validator tickets, a module choice and a validator, with no enclave requirement anywhere in it. The link the pufETH README still points at for "anti-slashing technology" returns a 404, and across all 46 URLs in the docs sitemap there is no page for Secure-Signer, RAVe, enclaves or attestation. The one slashing page that does exist is generic Ethereum PoS background and never mentions the enclave stack, though third-party write-ups still describe it as a live feature.
To be precise, because the draft of this report overstated it: enclaves are documented as live, on the Guardian side, where encrypted validator keyshares sit in enclaves built only to sign exit messages. What I found no evidence for is enclave attestation being enforced on node operators as an anti-slashing guarantee. What actually protects depositors from operator slashing today is economic and procedural: the operator forfeits their entire 2 ETH bond, and Guardians eject the validator. I am not claiming the enclave code was removed. I am saying you should not price in a hardware guarantee on the strength of a dead link.
Data appendix
- TVL: $45.97M (DeFiLlama, verified). The series moved to $46.65M on its 2026-08-12 point during this run. 90d: $63.90M, down 28.1%. 365d: $184.85M, down 75.1%. ATH $1,842,387,433 on 2024-06-06, down 97.5%. Last 30 days roughly flat, up 1.6%. DeFiLlama splits the parent into Puffer Stake ($45.55M), Puffer Vaults ($0.66M) and Puffer UniFi ($0.59M). Cross-check: 24,098.79 ETH at the ETH price implied by CoinGecko's pufETH quote ($1,908.69) clears $45.997M, within 0.06% of the verified figure.
- Vault state: pufETH supply 22,278.03, totalAssets 24,098.79 ETH, rate 1.081729 ETH per pufETH. Liquid buffer 514.44 ETH (514.06 native ETH, 0.38 stETH, zero WETH), 2.13% of assets, about $982k. Staked 23,584.35 ETH, 97.87%, implying roughly 737 validators at 32 ETH each; the 1,417.90 pufETH bond pool implies about 767 at a 2 ETH bond, consistent within 4%.
- Secondary liquidity: four pools. Curve wstETH/pufETH
0xEEda34A3holds 349.10 pufETH against 233.68 wstETH; Uniswap v3 pufETH/WETH0xBDB04e91holds 43.30 against 253.48 WETH; Curve pufETH/WETH0x39F5b252holds 28.71 against 21.82 WETH; Curve pufETH/wstETH0xb3c8ce1eholds 1,020.12 against 36.10 wstETH and is not indexed by DexScreener. Total pufETH in pools 1,441.24, or 6.47% of supply. Buy-side depth about 610 ETH-equivalent. 24h volume about $2.2k across the three indexed pools ($2.6k per CoinGecko). Market price 1.0776 to 1.0807 ETH, a 0.10% to 0.38% discount to NAV. - Holder concentration: top holder
0xd5549b9e07c1ff372b1a3912e184213bfe37bf25, an EOA with no public label, holds 11,196.79 pufETH, 50.26% of supply, a claim on about 12,112 ETH and 23.5x the liquid buffer. Confirmed by directbalanceOfagainst a public node, not only by the holder-list provider. Mint history: 0.93 on 2026-02-25, 9,907.71 on 2026-02-26, transferred out 9,908.65 and minted 11,196.79 on 2026-03-25. Top 15 hold about 85% of supply, one slot being PufferProtocol0xf7b6b324with 1,417.90 pufETH of node operator bonds plus 480,121 validator tickets. - Audits: BlockSec v1 and v2, SlowMist v1 and v2, Quantstamp v1, Immunefi Boost v1, Trail of Bits v2, Nethermind v2, Creed v2, per the PufferFinance/pufETH README. Trail of Bits, Nethermind, BlockSec (April 2024) and Creed (April 2024) links all resolve. The repo
audits/directory also contains an unlisted 0xLuckyLuke report. SlowMist v2 has no link. All Immunefi Puffer URLs return 404. Coverage of live implementation0x3b2fdfdefe919dbcce0bc5ac426097d5523b8afa: refresh. - Admin/governance: Timelock
0x3C28B7c7Ba1A1f55c9Ce66b263B33B204f2126eA(verified source, ContractName "Timelock", solc 0.8.23, not a proxy),delay()= 604801s,MINIMUM_DELAY7 days. Constructor arguments in order: community0x446d4d6b26815f9ba78b5d454e303315d586cb2a, operations0xc0896ab1a8cae8c2c1d27d011eb955cca955580d, pauser0x1ba8e3aa853f73ae8093e26b7b8f2520c3620df4, AccessManager0x8c1686069474410E6243425f4a10177a94EBEE11. Thresholds read on chain: community 3-of-6, operations 3-of-6, pauser 1-of-9, all matching the docs.hasRole(ADMIN_ROLE, Timelock)true;canCall(Timelock, pufETH, upgradeToAndCall)true with zero delay. Shared signer across community and operations:0xd70aa9d7280e6fee89b86f53c0b2a363478d5e94. All six community signers also sit on the 1-of-9 pauser Safe. - Oracle: No external price oracle. pufETH rate set by on-chain accounting updated by permissioned Guardians (lazy proof of reserves; PufferOracle
0x0BE2aE0edbeBb517541DF217EF0074FC9a9e994f). Guardian membership and exact quorum: refresh. - Exit mechanics: 1-step instant withdrawal charges a 1% fee paid to the treasury and funds PUFFER buybacks, limited by the vault buffer. 2-step standard withdrawal is free, minimum 0.01 pufETH, "around 14 days", requires Guardians to send voluntary exits and queue EigenLayer withdrawals at 32 ETH per validator, then a backend processes batches. Both confirmed on the docs withdraw page.
- Incidents: zero Puffer records across 621 entries in DeFiLlama's hacks dataset. No exploit, depeg or slashing event found in news scans.
- Recent events: Anchorage Digital institutional custody integration for pufETH announced 2026-03-12, confirmed on Anchorage's own newsroom as well as multiple outlets. Binance and KuCoin delisted PUFFER perpetuals on 2026-04-08; secondary reports describe a short squeeze swinging price from about $0.0204 to $0.0481 intraday.
- Funding: $18M Series A announced 2024-04-16, co-led by Brevan Howard Digital and Electric Capital, with Coinbase Ventures, Kraken Ventures, Franklin Templeton, Fidelity-affiliated Avon Ventures, Lemniscap, Mechanism, Lightspeed Faction, Consensys, Animoca and GSR, structured as a SAFT at a $200M token valuation, plus an earlier Binance Labs strategic round. PUFFER today: $0.012584, $6.37M market cap, $12.58M FDV (down about 94% from the SAFT mark), 506.6M of 1B circulating, ATH $0.9908 on 2024-12-07, down 98.7%.
Maintained monthly. Methodology: DeFi Research Instruction v2.