Skip to content
PROTOCOL RESEARCH

Puffer risk

Multiply-audited pufETH with a healthy repricing peg and a real withdrawal path, but a collapsed and shrinking TVL, an upgradeable admin surface, now-live EigenLayer slashing exposure, and a 2025 front-end/social hijack keep it at caution, not solid.
CautionResearched Jul 1, 2026

Scorecard

strong: Audits & contractsAudited by SlowMist (Jan 2024), Quantstamp (Feb 2024) and BlockSec (Apr 2024), plus an Immunefi audit competition; contracts are upgradeable and no continuous bug bounty is live.
watch: Admin controlUpgradeable via OZ AccessManager behind a ~1-week (7-day) timelock; three multisigs (pauser, operations, community) where the community set can veto and bypass the delay. Exact signer counts differ between sources.
watch: OracleRepricing rate is protocol-reported (Guardians post validator/reward data on-chain); pufETH:ETH rate is protocol-computed, not a market oracle.
watch: Liquidity & exitInstant exit costs 1% and needs vault liquidity; fee-free path is a two-step ~14-21 day EigenLayer plus exit-queue wait.
strong: Yield (real vs emission)Base yield is real (PoS staking plus EigenLayer restaking); points and PUFFER emissions are separate and largely already distributed.
watch: Holder concentrationNot verified this run; PUFFER is down 98.6% from ATH at a ~$6.5M cap, so the token-holder base is thin. _refresh_.
watch: Track recordNo contract exploit or pufETH fund loss, but an Aug 2025 website/X hijack and an Oct 2024 claims DDoS show front-end op-sec gaps; a historical secondary-market depeg (max -5.5% Aug 2024) came from redemption friction.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$46.3M
30d↑2%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

Puffer's pufETH is a native liquid restaking token on EigenLayer. The contracts have been audited by three firms and there is no record of a protocol-level exploit or a loss of pufETH-holder funds. Two things push this to caution rather than solid. First, the fundamentals shrank hard: TVL is around $44M, down roughly 98% from a ~$1.84B points-era peak and still bleeding, so this is now small and less battle-tested than Lido or ether.fi. Second, the trust surface is not just the contracts. The pufETH vault is upgradeable (behind a roughly one-week timelock with a community veto), it inherits EigenLayer slashing risk that went live on mainnet in April 2025, and in August 2025 Puffer's website and X account were hijacked in a phishing redirect. The peg itself is fine, and the native-slashing risk is partly engineered away, but the combination keeps this out of solid territory.

Checklist

Audits & contracts. Audited by SlowMist (Jan 2024), Quantstamp (Feb 2024) and BlockSec (Apr 2024), plus an Immunefi audit competition. BlockSec's report flagged one high and two medium issues, resolved pre-launch. LlamaRisk flagged the lack of a continuous bug-bounty program as a gap. Core vault contracts are upgradeable, not immutable. Admin control. Access is managed by an OpenZeppelin AccessManager behind a timelock that enforces a roughly one-week (7-day) delay on upgrades and critical calls; the timelock owns the AccessManager. Three multisigs sit above it: a pauser multisig for emergencies, an operations multisig for day-to-day actions (routed through the timelock), and a community multisig of reputable Ethereum members that can veto operations actions and bypass the delay. The exact signer thresholds differ between sources (LlamaRisk lists 1/12 pauser, 3/6 operations, 3/8 community; other write-ups cite 1-of-9 and 3-of-5), so treat the precise counts as unconfirmed. Upgradeable, but with real delay and a community veto. Oracle. pufETH is a repricing token: its value against ETH accrues from staking and restaking yield rather than tracking a market oracle. Guardians post validator reward and ticket-pricing data on-chain. The pufETH:ETH rate is protocol-computed, not a Chainlink feed, so the honesty of that accounting is the trust point. Liquidity & exit. Two paths. Instant redemption charges a 1% fee and only works while the PufferVault holds enough ETH. The fee-free path is a two-step withdrawal taking a minimum of 14 days and up to roughly 14 to 21 days, bounded by the EigenLayer withdrawal delay and the Ethereum exit queue. Large redemptions can force validator exits (32 ETH each) to free liquidity. Yield: real vs emission. The base yield is real: Ethereum PoS staking plus EigenLayer restaking rewards. Points programs and the PUFFER token are a separate, emission-style layer, and most of that airdrop is already distributed. Do not price the report on points. Holder concentration. Not verified this run (needs an agent or Nansen run). Context: PUFFER trades at about $0.013, down 98.6% from its ATH, with a ~$6.5M market cap and ~484M of 1B supply circulating, so the token holder base is thin and the FDV overhang is real. refresh. Track record. No smart-contract exploit and no loss of pufETH-holder funds on record. The Immunefi "critical" withdrawal-slashing finding was a reported-and-remediated audit-competition submission, not an on-chain exploit. Two operational incidents did happen: an August 2025 hijack of Puffer's website and X account (a phishing redirect, not a contract breach; the team paused contracts precautionarily and funds were confirmed safe), and an October 2024 DDoS on the token-claims page. pufETH also saw a historical secondary-market discount (max around -5.5% in August 2024) driven by redemption friction, not a fund loss. The contracts held throughout; the perimeter did not. Note: the September 2025 mass-slashing event on Ethereum involved SSV Network operators, not Puffer.

Worst case

Two distinct paths. Contract path: a compromised or coerced admin flow pushes a malicious upgrade. The one-week timelock and the community multisig's veto are designed to catch exactly this, so it is not instant, but the vault is upgradeable, so it is not off the table either. Restaking path: EigenLayer slashing is live on mainnet as of April 2025, so an operator or AVS that Puffer restakes into could be slashed and pufETH's redemption value could drop below the accrued rate. Slashing is opt-in per AVS and operators cap their exposure, and Puffer's Secure-Signer, TEE (Intel SGX) and Validator Ticket design reduce the native-slashing case, but restaking-layer slashing is an inherited risk you cannot fully audit away. Separately, the front-end hijack pattern means the realistic near-term loss vector for a user is being phished at a spoofed puffer.fi, not a contract failure. There is no insurance fund, so position sizing and bookmarking the real contracts are the mitigations.

Bottom line

Caution. The contracts are well-audited and there is no exploit history, the peg is a healthy repricing premium (pufETH ~1.076 ETH), and a real withdrawal path exists. But TVL has collapsed to ~$44M and keeps sliding, the vault is upgradeable, it carries now-live EigenLayer slashing exposure, and a 2025 website/social hijack showed the perimeter is soft. No confirmed fund-loss deal-breaker, but enough live yellow on size, admin, and op-sec to keep it below solid.

Data appendix

  • TVL: ~$44.08M (DeFiLlama, live). ATH ~$1.84B mid-June 2024 (points era). Down ~98% from peak. Source: DeFiLlama api.llama.fi/protocol/puffer-finance.
  • pufETH peg: 1.076 ETH ($1,745 vs ETH ~$1,622), a correct repricing premium, not a depeg. Source: CoinGecko.
  • PUFFER token: ~$0.0134, mcap ~$6.5M, FDV ~$13.4M, circ ~484M / 1B, -98.6% from ATH ($0.99, Dec 2024). Source: CoinGecko.
  • Audits: SlowMist (Jan 2024), Quantstamp (Feb 2024), BlockSec (Apr 2024); Immunefi audit competition. Continuous bug bounty noted as absent by LlamaRisk. Sources: BlockSec audit report, Immunefi, LlamaRisk.
  • Admin/governance: OZ AccessManager + ~1-week (7-day) Timelock that owns the AccessManager. Three multisigs (pauser, operations, community); community can veto + bypass. Exact signer counts differ by source (LlamaRisk: 1/12, 3/6, 3/8; other write-ups: 1-of-9, 3-of-5). Snapshot puffer-vote.eth. Sources: LlamaRisk, simplystaking, BlockSec audit summary.
  • Withdrawal: 1-step instant (1% fee, liquidity-gated) or 2-step fee-free (min 14 days, up to ~14-21 days, EigenLayer + exit queue). Source: Puffer docs / Medium, LlamaRisk.
  • Slashing: EigenLayer slashing live on mainnet since April 17, 2025 (opt-in per AVS). Puffer mitigation: Secure-Signer + TEE (Intel SGX), RAVe, Validator Tickets; restaking via permissioned operators. Sources: EigenCloud, LlamaRisk.
  • Incidents: Aug 2025 website + X hijack (phishing redirect, contracts paused, funds safe); Oct 2024 claims-page DDoS; historical secondary-market discount max ~-5.5% Aug 2024. No contract exploit / no pufETH fund loss. Sources: AInvest, PANews, BitcoinWorld, LlamaRisk.
  • UniFi: based-rollup / preconf AVS still on testnet (V2 launched Aug 2025), mainnet targeted Q4 2025; not verified as introducing new pufETH admin surface. refresh.
  • Holder concentration: refresh (agent / Nansen run). Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols