{
"badges": [],
"description": "Rocket Pool is an Ethereum liquid staking protocol. Users deposit ETH and receive rETH, a token whose value tracks the protocol's pooled ETH and staking rewards. Validators are run by registered node operators who combine their own ETH bond with ETH supplied by the pool. Withdrawal credentials point to protocol contracts, so operators cannot take user principal. The core trust surface is a 6-of-10 oracle set that reports the balances used to price rETH, with each report limited to a 2% price move and one report every 1 day. The same oracle set can upgrade protocol contracts after a delay of 7 days, subject to a veto by a 2 of 3 (67%) security council Safe. On-chain redemptions cannot be paused, but depend on available protocol liquidity.",
"detailedDescription": "Rocket Pool is an Ethereum staking pool. Anyone can deposit ETH and receive rETH, a token that appreciates against ETH as the pool's validators earn rewards. Node operators run the validators by putting up part of the stake, with the pool supplying the remainder, and never take custody of depositors' ETH. A permissioned oracle set of 10 node operators writes the number that rETH prices itself from, and the same set is the only actor that can change protocol code.\n\n### Depositing\n\nDepositing is open to anyone with a minimum of 0.01 ETH. The protocol keeps a fee of 0.05% and mints rETH with the rest. Incoming ETH first refills the redemption buffer up to 1% of the tracked backing, and the remainder waits in RocketVault until it is matched to a validator, under a cap of 6,000,000 ETH on unassigned ETH. Deposits can be switched off instantly by the security council and by RPL governance.\n\n\n\n### Redeeming\n\nRedeeming is open to any holder and has no pause switch, but it pays only from liquid ETH, the token contract's buffer plus the deposit pool's unassigned surplus. When that runs out, redemption reverts and holders use the secondary market or wait. The protocol does not implement EIP-7002, so no contract can force a validator exit. Staked ETH returns only when validators leave the beacon chain, at the operator's initiative or through slashing.\n\n\n\n### The exchange rate\n\nThe rETH price is a stored number, total backing ETH divided by rETH supply, written by the oracle set. A report needs 6 of 10 members to agree, can move the price at most 2% in either direction, and can land once per 1 day. Reports do not expire, so a silent oracle freezes the price and minting and redemption continue at the stale value. A lying oracle is capped at 2% per report, but nothing caps the cumulative drift. Reporting can be switched off instantly by the security council. The same set also reports the RPL price and the rewards tree, and a seat requires a bond of 1,750 RPL that the other members can burn by voting the member out.\n\n### Node operators\n\nOperators post part of each validator's 32 ETH as a bond and borrow the rest from the pool. Registration of new operators is a protocol switch, currently disabled. Staking RPL is optional, it adds governance voting power and a share of protocol revenue, and unstaking takes 28 days. Staked RPL is held by protocol contracts, so a contract upgrade by the oracle set can reach it. Operators cannot take depositors' ETH. Validator withdrawals land in a protocol contract that splits them on-chain between operator and pool, anyone can trigger the split, and exits are proven against beacon-chain state rather than reported. The oracle set can fine an operator in ETH at 51% agreement, capped at 612 ETH per penalty and over a rolling window.\n\n### Governance and upgrades\n\nOnly an executed oracle-set proposal can change protocol code. Voting cannot open until 7 days after a proposal is made, and a passed upgrade waits another 7 days before any member can execute it. The lane's reach is nearly total, everything including the deposit pool and the balance oracle is replaceable through it, and only a short fixed list of contracts, among them the vault and the tokens, keeps its code. RPL governance cannot upgrade anything.\n\n**The security council**\n\nMembership is held by a 2 of 3 (67%) Safe appointed by RPL governance. The council can veto a pending upgrade while it waits out its delay, and can instantly flip an allowlist of settings, today mostly on and off switches for deposits, registrations, and oracle reporting, plus a capped nudge to the node commission share. It cannot upgrade contracts, move funds, or stop redemption.\n\n**RPL governance**\n\nRegistered node operators vote with their staked RPL, counted up to 150% of their bonded ETH value. RPL held outside a node carries no vote. Voting power is proven optimistically, a proposer bonds 100 RPL, anyone can challenge a claimed tally with 10 RPL, and an unanswered challenge defeats the proposal after 30 minutes. What passes can set any protocol parameter, spend the treasury, and change the council's membership, but cannot change code.\n\n**The guardian**\n\nAn externally owned account left from deployment. Its original admin powers are permanently disabled, but it still sets the penalty ceiling for legacy validators, with no upper bound and no way for governance to reach or revoke that power.\n\n### What cannot be changed\n\nNo party can upgrade the vault or the token contracts, redirect a funded validator's payout, pause redemption, or move a holder's tokens. Withdrawal credentials are fixed to the validator contract when it is funded. The oracle set can misprice rETH by 2% per report and, after the delays above and absent a veto, replace the code that computes the price. The security council can stop deposits and freeze the price immediately. Neither can reach the pool's ETH without first changing code through the delayed lane.",
"detailedDescription": "Rocket Pool is an Ethereum staking pool. Anyone can deposit ETH and receive rETH, a token that appreciates against ETH as the pool's validators earn rewards. Node operators run the validators by putting up part of the stake, with the pool supplying the remainder, and never take custody of depositors' ETH. A permissioned oracle set of 10 node operators writes the number that rETH prices itself from, and the same set is the only actor that can change protocol code.\n\n### Depositing\n\nDepositing is open to anyone with a minimum of 0.01 ETH. The protocol keeps a fee of 0.05% and mints rETH with the rest. Incoming ETH first refills the redemption buffer up to 1% of the tracked backing, and the remainder waits in RocketVault until it is matched to a validator, under a cap of 6,000,000 ETH on unassigned ETH. Deposits can be switched off instantly by the security council and by RPL governance.\n\n\n\n### Redeeming\n\nRedeeming is open to any holder and has no pause switch, but it pays only from liquid ETH, the token contract's buffer plus the deposit pool's unassigned surplus. When that runs out, redemption reverts and holders use the secondary market or wait. The protocol does not implement EIP-7002, so no contract can force a validator exit. Staked ETH returns only when validators leave the beacon chain, at the operator's initiative or through slashing.\n\n\n\n### The exchange rate\n\nThe rETH price is a stored number, total backing ETH divided by rETH supply, written by the oracle set. A report needs 6 of 10 members to agree, can move the price at most 2% in either direction, and can land once per 1 day. Reports do not expire, so a silent oracle freezes the price and minting and redemption continue at the stale value. A lying oracle is capped at 2% per report, but nothing caps the cumulative drift. Reporting can be switched off instantly by the security council. The same set also reports the RPL price and the rewards tree, and a seat requires a bond of 1,750 RPL that the other members can burn by voting the member out.\n\n### Node operators\n\nOperators post part of each validator's 32 ETH as a bond and borrow the rest from the pool. Registration of new operators is a protocol switch, currently enabled. Staking RPL is optional, it adds governance voting power and a share of protocol revenue, and unstaking takes 28 days. Staked RPL is held by protocol contracts, so a contract upgrade by the oracle set can reach it. Operators cannot take depositors' ETH. Validator withdrawals land in a protocol contract that splits them on-chain between operator and pool, anyone can trigger the split, and exits are proven against beacon-chain state rather than reported. The oracle set can fine an operator in ETH at 51% agreement, capped at 612 ETH per penalty and over a rolling window.\n\n### Governance and upgrades\n\nOnly an executed oracle-set proposal can change protocol code. Voting cannot open until 7 days after a proposal is made, and a passed upgrade waits another 7 days before any member can execute it. The lane's reach is nearly total, everything including the deposit pool and the balance oracle is replaceable through it, and only a short fixed list of contracts, among them the vault and the tokens, keeps its code. RPL governance cannot upgrade anything.\n\n**The security council**\n\nMembership is held by a 2 of 3 (67%) Safe appointed by RPL governance. The council can veto a pending upgrade while it waits out its delay, and can instantly flip an allowlist of settings, today mostly on and off switches for deposits, registrations, and oracle reporting, plus a capped nudge to the node commission share. It cannot upgrade contracts, move funds, or stop redemption.\n\n**RPL governance**\n\nRegistered node operators vote with their staked RPL, counted up to 150% of their bonded ETH value. RPL held outside a node carries no vote. Voting power is proven optimistically, a proposer bonds 100 RPL, anyone can challenge a claimed tally with 10 RPL, and an unanswered challenge defeats the proposal after 30 minutes. What passes can set any protocol parameter, spend the treasury, and change the council's membership, but cannot change code.\n\n**The guardian**\n\nAn externally owned account left from deployment. Its original admin powers are permanently disabled, but it still sets the penalty ceiling for legacy validators, with no upper bound and no way for governance to reach or revoke that power.\n\n### What cannot be changed\n\nNo party can upgrade the vault or the token contracts, redirect a funded validator's payout, pause redemption, or move a holder's tokens. Withdrawal credentials are fixed to the validator contract when it is funded. The oracle set can misprice rETH by 2% per report and, after the delays above and absent a veto, replace the code that computes the price. The security council can stop deposits and freeze the price immediately. Neither can reach the pool's ETH without first changing code through the delayed lane.",
"links": {
"websites": [
"https://rocketpool.net/"
],
"documentation": [
"https://docs.rocketpool.net/"
],
"repositories": [
"https://github.com/rocket-pool/rocketpool"
],
"socialMedia": [
"https://x.com/Rocket_Pool"
]
},
"references": [
{
"title": "RPIP-61: rETH exchange rate update bounds",
"url": "https://rpips.rocketpool.net/RPIPs/RPIP-61"
},
{
"title": "RPIP-33: Protocol DAO governance",
"url": "https://rpips.rocketpool.net/RPIPs/RPIP-33"
}
]
}
contracts+2-17
{
"addresses": {
"ethereum": [
{
"name": "RocketMinipoolDelegate",
"isVerified": true,
"address": "eth:0x03d30466d199Ef540823fe2a22CAE2E3b9343bb0",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Shared implementation behind every legacy validator contract. It holds the operator's bond and the matched pooled ETH, tracks the validator's lifecycle, and splits withdrawals between the operator and the pool by the commission recorded at creation. Distributing the contract's balance is open to any caller while the validator is staking; only distributing an already-dissolved contract is restricted to the operator. An absent operator therefore cannot hold the pooled share.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x03d30466d199Ef540823fe2a22CAE2E3b9343bb0#code"
},
{
"name": "RocketAuctionManager",
"isVerified": true,
"address": "eth:0x1a2F00D187C9388fDa3Bf2dc46a6b4740849EcCE",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Dutch auction that sells collateral tokens seized from node operators back for ETH, returning the ETH to the pool. Lot creation and bidding are permissionless when their flags are on, and the price decays from a governed starting ratio to a governed reserve ratio over a fixed number of blocks. Both flags are on the security council's allowlist.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1a2F00D187C9388fDa3Bf2dc46a6b4740849EcCE#code"
},
{
"name": "RocketMegapoolProxy",
"isVerified": true,
"address": "eth:0x1B389D76a04d01026c5f5B0a125D4CCF26F9cd51",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Proxy base each node operator's pooled validator contract runs. It delegates to the shared implementation resolved from the registry; the operator chooses whether to track the latest implementation or stay on the current one, within an expiry after which tracking resumes. The copy registered here is the uninitialised template.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1B389D76a04d01026c5f5B0a125D4CCF26F9cd51#code"
},
{
"name": "RocketStorage",
"isVerified": true,
"address": "eth:0x1d8f8f00cfa6758d7bE78336684788Fb0ee0Fa46",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Eternal-storage registry and the root of the protocol. It holds every protocol variable in typed key-value maps and is the only contract with persistent state; the logic contracts are stateless and read and write through it. Each logic contract is registered under the hash of its name, so repointing a name in a single write moves every caller to a new implementation on its next call. Write access is limited to addresses flagged as registered contracts, which means the registry itself imposes no delay: any delay comes from the contract performing the write. Registered names are not enumerable on-chain, so discovery resolves each one by calling the address lookup with its name hash.\n* Roles:\n * **getGuardian**: EOA 1\n * **rocketDAONodeTrustedUpgrade**: RocketDAONodeTrustedUpgrade; ultimately RocketDAONodeTrusted\n * **rocketDAOProtocolProposals**: RocketDAOProtocolProposals; ultimately RocketDAOProtocolProposal\n * **rocketDAOSecurityProposals**: RocketDAOSecurityProposals; ultimately RocketDAOSecurity",
"upgradableBy": [
{
"name": "RocketDAONodeTrusted",
"delay": "7d"
}
],
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1d8f8f00cfa6758d7bE78336684788Fb0ee0Fa46#code"
},
{
"name": "RocketNetworkBalances",
"isVerified": true,
"address": "eth:0x1D9F14C6Bfd8358b589964baD8665AdD248E9473",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Balance oracle. Members of the oracle set submit the network's total ETH, its staked ETH, and the liquid staking token supply for a block; a report is written once submissions reach 51% of the set, and anyone can finalise a report that has already reached that share. The liquid staking token divides the two written values to get its redemption price, so this is the contract that sets that price. Three bounds apply: a report may not land until almost a full reporting interval of 1d has passed since the last one, the price may move by at most 2% per report, and reporting can be switched off by the setting below. Nothing here expires: if reporting stops, the last report stands indefinitely and the price stops tracking validator rewards.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1D9F14C6Bfd8358b589964baD8665AdD248E9473#code"
},
{
"name": "RocketNetworkPrices",
"isVerified": true,
"address": "eth:0x25E54Bf48369b8FB25bB79d3a3Ff7F3BA448E382",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Price oracle for the collateral token. Members of the oracle set submit a price for a block and it is written once submissions reach the network consensus share; anyone can finalise a report that already has that share. The price governs how much collateral a node operator must hold and what its stake is worth in auctions; it does not enter the liquid staking token's redemption price. Reporting can be switched off by a governed setting.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x25E54Bf48369b8FB25bB79d3a3Ff7F3BA448E382#code"
},
{
"name": "RocketNodeDistributorDelegate",
"isVerified": true,
"address": "eth:0x35A85d4c115801395e6E3abAa784Fb05826f129D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Shared implementation behind each node operator's fee-splitting proxy. Distribution is permissionless and pays the operator and the pool by the split recorded on-chain; nobody can redirect a share.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x35A85d4c115801395e6E3abAa784Fb05826f129D#code"
},
{
"name": "RocketVault",
"isVerified": true,
"address": "eth:0x3bDC69C4E5e13E52A65f5583c23EFB9636b469d6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Custody contract for the protocol's pooled ETH and ERC-20 balances. Balances are booked against the *name* of the registered contract that deposited them, and a registered contract can only withdraw, transfer, or burn against its own name; anyone can deposit. The registry refuses to repoint this name, so the address holding the funds cannot be changed, but a contract that is upgraded inherits the balance booked to the name it replaced.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x3bDC69C4E5e13E52A65f5583c23EFB9636b469d6#code"
},
{
"name": "AddressQueueStorage",
"isVerified": true,
"address": "eth:0x44E31944E1A6F3b8F805E105B130F8bdb7E2EBd8",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "FIFO queue of addresses kept in the shared registry, with a capacity bound per queue. Only registered contracts can write.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x44E31944E1A6F3b8F805E105B130F8bdb7E2EBd8#code"
},
{
"name": "LinkedListStorage",
"isVerified": true,
"address": "eth:0x52590E8aaC140E2020f8F51695719922ebcCb6D6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Doubly linked list kept in the shared registry, used for queues that must support removal from the middle. Only registered contracts can write.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x52590E8aaC140E2020f8F51695719922ebcCb6D6#code"
},
{
"name": "RocketMinipoolBase",
"isVerified": true,
"address": "eth:0x560656C8947564363497E9C78A8BDEff8d3EFF33",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Proxy base every legacy validator contract runs. It delegates to a shared implementation resolved from the registry; the validator's owner chooses whether to track the latest implementation or pin the one they upgraded to, and can roll back one version. The copy registered here is the uninitialised template, so its own slots are empty.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x560656C8947564363497E9C78A8BDEff8d3EFF33#code"
},
{
"name": "RocketNetworkSnapshotsTime",
"isVerified": true,
"address": "eth:0x569F5b3024054AB4049A50df223a747AFE18a891",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Timestamp-indexed history of protocol values, used for the rolling windows that bound penalties. Only registered contracts can append, and entries are append-only.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x569F5b3024054AB4049A50df223a747AFE18a891#code"
},
{
"name": "RocketNodeDeposit",
"isVerified": true,
"address": "eth:0x6B13698c306a297Fee1383cdC2c65d63781D2D47",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Takes a node operator's own ETH bond and creates the validator that the pooled deposit is matched against. The bond size is fixed by governed settings, and the operator's ETH and the pooled ETH are held by the validator contract, not by the operator.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x6B13698c306a297Fee1383cdC2c65d63781D2D47#code"
},
{
"name": "RocketMinipoolFactory",
"isVerified": true,
"address": "eth:0x7B8c48256CaF462670f84c7e849cab216922B8D3",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Deploys legacy validator contracts as minimal proxies at addresses derived from the operator address and a salt, so the address is known before deployment. Only a registered contract can deploy one.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x7B8c48256CaF462670f84c7e849cab216922B8D3#code"
},
{
"name": "RocketNetworkRevenues",
"isVerified": true,
"address": "eth:0x9D9708dA8E0200Dd8Dd9ad09e0AAf184Ad260842",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Time-weighted record of how staking revenue is split between node operators, the depositors, and the governance voter share. Only a registered pooled validator contract or the security-council proposal contract can write here, and the council's write is bounded by the guardrails checked in that contract.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9D9708dA8E0200Dd8Dd9ad09e0AAf184Ad260842#code"
},
{
"name": "RocketMinipoolQueue",
"isVerified": true,
"address": "eth:0x9e966733e3E9BFA56aF95f762921859417cF6FaA",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Queue of legacy validator contracts waiting for pooled ETH. Entry and exit are driven by registered contracts only.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9e966733e3E9BFA56aF95f762921859417cF6FaA#code"
},
{
"name": "RocketMegapoolPenalties",
"isVerified": true,
"address": "eth:0xa2afC3C2d8ea4eBdbE925cADe17c29517630e6aB",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Penalty voting for the pooled per-node validator contracts. Members of the oracle set submit an ETH amount against one node's contract; it is applied once submissions reach 51% of the set. Each penalty is capped at 612 ETH, and the same cap is enforced as a running total over a rolling window whose length is a constant in the contract's code. A penalty reduces the node operator's share, not the pooled depositors'.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xa2afC3C2d8ea4eBdbE925cADe17c29517630e6aB#code"
},
{
"name": "RocketMinipoolStatus",
"isVerified": true,
"address": "eth:0xa52451b9d25EEf02BE42B3A8161A18f947F8A6a5",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Oracle-set entry point for marking a legacy validator contract withdrawable and for scrubbing one whose withdrawal credentials do not match before it is funded. The scrub window is a governed setting and is the check that stops an operator pointing pooled ETH at credentials they control.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xa52451b9d25EEf02BE42B3A8161A18f947F8A6a5#code"
},
{
"name": "RocketTokenRETH",
"isVerified": true,
"address": "eth:0xae78736Cd615f374D3085123A210448E74Fc6393",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Liquid staking token (rETH). Minting is restricted to the deposit-pool contract. Burning is open to any holder with no admin gate and no pause switch, but it pays out only from the ETH held here plus the deposit pool's unassigned surplus, so large redemptions depend on that buffer rather than on the staked balance. The redemption price is the ratio of two values written by the balance oracle, so this contract asserts no price of its own and has no staleness check. Governance targets a buffer of 1% of the token's backing. Transfers are blocked for a configured number of blocks after the holder deposits, currently 0. The registry refuses to repoint this name, so the token address is fixed.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xae78736Cd615f374D3085123A210448E74Fc6393#code"
},
{
"name": "RocketMegapoolDelegate",
"isVerified": true,
"address": "eth:0xca3DD4bee7C174903dBF66c3897c27E9ADaAEBdD",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Shared implementation behind every node operator's pooled validator contract. One contract holds many validators for one operator, keeping the operator bond and the matched pooled ETH separate in its accounting. Exits and final balances are proven against beacon-chain state rather than asserted by a reporter. Splitting the balance is open to any caller; only moving the operator's own share out is restricted to the operator, so an absent operator cannot withhold the pooled share.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xca3DD4bee7C174903dBF66c3897c27E9ADaAEBdD#code"
},
{
"name": "RocketRewardsPool",
"isVerified": true,
"address": "eth:0xCba5951fc706Fc783b7C142DaE8576Ebe29c41FD",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Accrues the token inflation and the pooled ETH rewards for each reward period and records the tree that splits them. A period is closed when submissions from the oracle set reach the network consensus share; anyone can finalise a submission that already has it. The tree itself is computed off-chain, so the oracle set is trusted for its contents; the totals it can distribute are bounded by what has accrued.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xCba5951fc706Fc783b7C142DaE8576Ebe29c41FD#code"
},
{
"name": "RocketDepositPool",
"isVerified": true,
"address": "eth:0xCE15294273CFb9D9b628F4D61636623decDF4fdC",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Entry point for user deposits and the queue that matches them to validators. A deposit is permissionless while the deposit flag is on; it must be at least 0.01 ETH, must leave the pool within the 6,000,000 ETH cap after queue assignments, pays a fee of 0.05% of the amount, and mints the liquid staking token for the remainder. Deposited ETH is held by the custody contract under this contract's name until it is assigned to a validator or withdrawn back as redemption collateral.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xCE15294273CFb9D9b628F4D61636623decDF4fdC#code"
},
{
"name": "RocketNodeManager",
"isVerified": true,
"address": "eth:0xcf2d76A7499d3acB5A22ce83c027651e8d76e250",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Register of node operators. It records registration, the operator's withdrawal address for ETH and for the collateral token, timezone, smoothing-pool membership, and the address of the operator's pooled validator contract. Changing a withdrawal address is a two-step confirm, so a mistyped address cannot strand the operator. New registrations are currently false.\n",
"description": "Register of node operators. It records registration, the operator's withdrawal address for ETH and for the collateral token, timezone, smoothing-pool membership, and the address of the operator's pooled validator contract. Changing a withdrawal address is a two-step confirm, so a mistyped address cannot strand the operator. New registrations are currently true.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xcf2d76A7499d3acB5A22ce83c027651e8d76e250#code"
},
{
"name": "RocketTokenRPL",
"isVerified": true,
"address": "eth:0xD33526068D116cE69F19A9ee46F0bd304F21A51f",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Inflationary collateral and governance token (RPL). New supply is issued by a permissionless call that mints the accrued amount to the rewards contract at a fixed rate of 1.0001336806171135 per interval of 1d; there is no privileged minter and no cap. It also swaps a fixed-supply predecessor token in at one to one, burning the token received. The registry refuses to repoint this name.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xD33526068D116cE69F19A9ee46F0bd304F21A51f#code"
},
{
"name": "AddressSetStorage",
"isVerified": true,
"address": "eth:0xD4ae2511dF21F367792bA4D67c6eb032171c6a16",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Set of addresses with O(1) membership, index lookup, and removal, kept in the shared registry. Only registered contracts can write.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xD4ae2511dF21F367792bA4D67c6eb032171c6a16#code"
},
{
"name": "RocketSmoothingPool",
"isVerified": true,
"address": "eth:0xd4E96eF8eee8678dBFf4d535E033Ed1a4F7605b7",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Holds the block-proposal income of operators who opted into pooled rewards. It only accepts ETH and lets a registered contract withdraw it; the split back to operators is decided by the periodic rewards tree, not here.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xd4E96eF8eee8678dBFf4d535E033Ed1a4F7605b7#code"
},
{
"name": "RocketMegapoolFactory",
"isVerified": true,
"address": "eth:0xD5bffeaa9f373B9C367132772FAA0b88e3F0E38b",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Deploys one pooled validator contract per node operator, at an address derived from the operator address, and holds the implementation those proxies delegate to.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xD5bffeaa9f373B9C367132772FAA0b88e3F0E38b#code"
},
{
"name": "RocketMinipoolBondReducer",
"isVerified": true,
"address": "eth:0xDe8Ab526b19FCA2D5a57c4A78b698041717BE591",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Lets a node operator lower the bond on an existing legacy validator, inside a governed window and only while the feature flag is on. A quorum of the oracle set can cancel a pending reduction during the window, which is the check against an operator reducing their own exposure without exiting.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xDe8Ab526b19FCA2D5a57c4A78b698041717BE591#code"
},
{
"name": "RocketNodeDistributorFactory",
"isVerified": true,
"address": "eth:0xe228017f77B3E0785e794e4c0a8A6b935bB4037C",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Deploys one minimal proxy per node operator, at an address derived from the operator's address, to split the fee-recipient income of that operator's legacy validators between the operator and the pool. The proxy code is fixed in this contract.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xe228017f77B3E0785e794e4c0a8A6b935bB4037C#code"
},
{
"name": "RocketNetworkSnapshots",
"isVerified": true,
"address": "eth:0xe37F2d9dFb7397caF671DF5190a5dFB601028f17",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Block-indexed history of protocol values, used so a vote can be settled against the state at the block a proposal was made. Only registered contracts can append, and entries are append-only.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xe37F2d9dFb7397caF671DF5190a5dFB601028f17#code"
},
{
"name": "RocketMerkleDistributorMainnet",
"isVerified": true,
"address": "eth:0xE4E2612EE8d7fdc8518Faea85770A3b9c886E2f5",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Claim contract for the periodic rewards tree. Anyone can claim on behalf of a node operator with a valid proof, and the proceeds always go to that operator's recorded withdrawal address, so a claim cannot be redirected. Roots are relayed only by the rewards contract.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xE4E2612EE8d7fdc8518Faea85770A3b9c886E2f5#code"
},
{
"name": "RocketMinipoolManager",
"isVerified": true,
"address": "eth:0xe54B8C641fd96dE5D6747f47C19964c6b824D62C",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Register of the legacy one-validator-per-contract deployments: creation, status counts, public-key mapping, and destruction. Individual validator contracts are not listed here because there are tens of thousands of them and they share one implementation.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xe54B8C641fd96dE5D6747f47C19964c6b824D62C#code"
},
{
"name": "RocketMinipoolPenalty",
"isVerified": true,
"address": "eth:0xE64AC47b6e2FEcfCDEA35147Fe61af9894A06ba6",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Cap on how much of a legacy validator contract's rewards the oracle set's penalty vote can divert. The cap lives in this contract's own storage rather than in the registry, deliberately putting it out of the oracle set's reach, and the registry refuses to repoint this name. Only the bootstrap account can change it, with no delay and no upper bound in the code. The effective penalty for a validator contract is the smaller of the cap and the voted rate, so a cap of zero disables legacy penalties entirely. The cap currently reads 0%.\n* Roles:\n * **guardian**: EOA 1",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xE64AC47b6e2FEcfCDEA35147Fe61af9894A06ba6#code"
},
{
"name": "BeaconStateVerifier",
"isVerified": true,
"address": "eth:0xE9a114c50f26001443B91079Ab5573a90D2D8469",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Verifies Merkle proofs against beacon-chain state roots obtained from the consensus-layer block-root precompile. It has no owner and no configurable trust root, so validator lifecycle facts are proven rather than reported.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xE9a114c50f26001443B91079Ab5573a90D2D8469#code"
},
{
"name": "RocketNetworkPenalties",
"isVerified": true,
"address": "eth:0xeD0493DE30e82bE7C16C8925C7204CE9D1136B3a",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Penalty voting for the legacy per-validator contracts. Members of the oracle set submit a penalty against one validator contract and a rate is recorded once submissions reach the governed share. The effect is capped separately by the penalty-cap contract, which is outside this registry's reach.\n* Roles:\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xeD0493DE30e82bE7C16C8925C7204CE9D1136B3a#code"
},
{
"name": "RocketNodeStaking",
"isVerified": true,
"address": "eth:0xedFc7DCaE43fF954577a2875a9D805874490eE3E",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Holds node operators' collateral-token stake. Staking and unstaking are open to the operator or their designated collateral withdrawal address; unstaking is a two-step withdrawal with a 28d waiting period. The stake is not inert: any registered contract can lock, burn, or transfer it, and a legacy validator contract can slash it, so an operator's collateral is exposed to whatever code is registered at those names.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xedFc7DCaE43fF954577a2875a9D805874490eE3E#code"
},
{
"name": "RocketMegapoolManager",
"isVerified": true,
"address": "eth:0xf2CCd522Ba5fFEda28fe0389963845D61F342034",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Global index of validators across all pooled validator contracts, and the entry point for the beacon-state proofs that record a validator staking, exiting, or failing to exit. Anyone can submit a valid proof; the checks are cryptographic, not permissioned.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xf2CCd522Ba5fFEda28fe0389963845D61F342034#code"
},
{
"name": "RocketNetworkFees",
"isVerified": true,
"address": "eth:0xf824e2d69dc7e7c073162C2bdE87dA4746d27a0f",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Derives the commission a new validator is created with from how full the deposit pool is relative to a governed demand range, between a governed minimum and maximum. It is pure arithmetic over governed settings; nobody sets the number directly.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xf824e2d69dc7e7c073162C2bdE87dA4746d27a0f#code"
},
{
"name": "RocketDAONodeTrustedActions",
"isVerified": true,
"address": "eth:0x029d946F28F93399a5b0D09c879FC8c94E596AEb",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Executes the membership changes the oracle set has voted for: accepting an invitation against a posted bond, leaving and reclaiming the bond, being removed with an optional fine, and the challenge process that removes a member who stops responding.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x029d946F28F93399a5b0D09c879FC8c94E596AEb#code"
},
{
"name": "RocketDAOProtocolSettingsInflation",
"isVerified": true,
"address": "eth:0x1d4AAEaE7C8b75a8e5ab589a84516853DBDdd735",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of collateral-token issuance: the per-interval rate and the start time of the first interval. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1d4AAEaE7C8b75a8e5ab589a84516853DBDdd735#code"
},
{
"name": "RocketDAOProposal",
"isVerified": true,
"address": "eth:0x1e94e6131Ba5B4F193d2A1067517136C52ddF102",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Shared proposal store for the two member-based bodies, the oracle set and the security council. It records the payload, the vote counts, and the schedule, and executes the payload against the proposing body once the vote count reaches the required threshold. A proposal becomes executable the instant it reaches its threshold, so the voting window is an upper bound, not a delay.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x1e94e6131Ba5B4F193d2A1067517136C52ddF102#code"
},
{
"name": "RocketDAOProtocolSettingsDeposit",
"isVerified": true,
"address": "eth:0x227BE8dD01DF8ad9BED0178e4F8cEC2996C5c365",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of the user deposit path: whether deposits and assignment are enabled, the minimum deposit, the pool size cap, the deposit fee, and how many validators one deposit may fund. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x227BE8dD01DF8ad9BED0178e4F8cEC2996C5c365#code"
},
{
"name": "RocketDAOSecurityProposals",
"isVerified": true,
"address": "eth:0x334B9B1a6F9d7531efb13746482ff40f1c2a0c4e",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Proposal front end for the security council, limited to an explicit allowlist of settings. Every write checks a per-setting allow flag in the registry and reverts if it is not set, so the council can only touch keys that token-holder governance has opened to it; which keys are open is registry state, read from the chain at discovery time as one flag per setting. A numeric setting on the list is additionally capped by the executing code. A proposal here becomes executable the moment it reaches quorum, with no delay of its own.\n* Roles:\n * **securityCouncil**: RocketDAOSecurity",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x334B9B1a6F9d7531efb13746482ff40f1c2a0c4e#code"
},
{
"name": "RocketDAOProtocolSettingsAuction",
"isVerified": true,
"address": "eth:0x364F989A3C9a1F66cB51b9043680974eA08C0d18",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of the collateral auction: whether lots may be created and bid on, lot size bounds, duration, and the starting and reserve price ratios. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x364F989A3C9a1F66cB51b9043680974eA08C0d18#code"
},
{
"name": "RocketDAOProtocolSettingsMegapool",
"isVerified": true,
"address": "eth:0x40628FAAc22383327b9f7bBc86CD1857050A2dCe",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of the pooled validator contracts: penalty ceiling and threshold, dissolve timing and penalty, late-notification fine, and the delays after which anyone may distribute. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x40628FAAc22383327b9f7bBc86CD1857050A2dCe#code"
},
{
"name": "RocketDAOProtocolSettingsNetwork",
"isVerified": true,
"address": "eth:0x67Fd03a5095197D1aD1F932BC55E022C420b1153",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Network-wide parameters: the oracle consensus share, reporting frequencies and switches, the cap on how far the redemption price may move per report, the commission bounds and demand range, the revenue split, and the target redemption buffer. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x67Fd03a5095197D1aD1F932BC55E022C420b1153#code"
},
{
"name": "RocketDAONodeTrustedSettingsRewards",
"isVerified": true,
"address": "eth:0x7322c24752f79c05FFD1E2a6FCB97020C1C264F1",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Per-network switches for where reward claims may be directed. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x7322c24752f79c05FFD1E2a6FCB97020C1C264F1#code"
},
{
"name": "RocketDAOProtocolSettingsRewards",
"isVerified": true,
"address": "eth:0x8857610Ba0A7caFD4dBE1120bfF03E9c74fc4124",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of the reward periods: the period length, the number of periods in a claim interval, and the split of issuance between node operators, the oracle set, and the treasury. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x8857610Ba0A7caFD4dBE1120bfF03E9c74fc4124#code"
},
{
"name": "RocketDAONodeTrustedUpgrade",
"isVerified": true,
"address": "eth:0x9290AA076a2F1418a4E414E3D83AE03cA8E1ad10",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "The only path that changes which code the protocol runs. A passed oracle-set proposal records a pending change here rather than applying it; the change becomes applicable after 7d and, until then, the security council can cancel it. Once the delay has run and the change was not cancelled, any oracle-set member applies it. A fixed list of names is refused outright: the custody contract, the token contracts, the beacon-chain deposit contract, and the penalty-cap contract. Registering an entirely new name is allowed and grants that address write access to the registry, which is how the exclusion list is worked around. The bootstrap account had an immediate path here; it is permanently closed.\n* Roles:\n * **councilVeto**: RocketDAOSecurityUpgrade; ultimately RocketDAOSecurity\n * **oracleSet**: RocketDAONodeTrusted",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9290AA076a2F1418a4E414E3D83AE03cA8E1ad10#code"
},
{
"name": "RocketDAOSecurityUpgrade",
"isVerified": true,
"address": "eth:0x950BaF0358164339114914169BF16754789B5Dc4",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Veto lever over pending contract changes. A council member proposes a veto against a change that is still inside its waiting period; the veto passes at 33% of the council's seats and takes effect as soon as it reaches that threshold, so it always lands inside the window. A vetoed change can never be applied. This contract can only cancel changes; it cannot make one.\n* Roles:\n * **securityCouncil**: RocketDAOSecurity",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x950BaF0358164339114914169BF16754789B5Dc4#code"
},
{
"name": "RocketNetworkVoting",
"isVerified": true,
"address": "eth:0x994A9C49230FEC0c127B8F42D6c5288F02610AeD",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Computes an address's voting power at a past block from its staked collateral and its share of the validator bond, and records vote delegation. It reads the snapshot history rather than holding balances of its own.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x994A9C49230FEC0c127B8F42D6c5288F02610AeD#code"
},
{
"name": "RocketDAONodeTrustedSettingsProposals",
"isVerified": true,
"address": "eth:0xAD038f8994a6bd51C8A72D3721CEd83401D4d2b0",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of oracle-set proposals: the cooldown between one member's proposals, the delay before voting opens, the voting window, and the execution window. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xAD038f8994a6bd51C8A72D3721CEd83401D4d2b0#code"
},
{
"name": "RocketDAOProtocolSettingsMinipool",
"isVerified": true,
"address": "eth:0xaeF94C3650AA13d7A2456477fc374a16b94B9152",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of the legacy validator contracts: launch timeout, bond-reduction and withdrawable-submission switches, and the window in which anyone may distribute. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xaeF94C3650AA13d7A2456477fc374a16b94B9152#code"
},
{
"name": "RocketDAOProtocolSettingsNode",
"isVerified": true,
"address": "eth:0xb02B883303e658Ddcd58D3871Dc4Ca0C91f0fc9D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters for node operators: whether registration and node deposits are enabled, bond sizes, the minimum collateral stake, the unstaking waiting period, and the cap on stake that counts toward voting power. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xb02B883303e658Ddcd58D3871Dc4Ca0C91f0fc9D#code"
},
{
"name": "RocketDAONodeTrustedProposals",
"isVerified": true,
"address": "eth:0xb0ec3F657ef43A615aB480FA8D5A53BF2c2f05d5",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Proposal front end for the oracle set. Only a seated member can propose, and only after a per-member cooldown; voting opens after a delay and runs for a fixed window, with one vote per member. A passed proposal can invite, remove, or fine a member, change the oracle set's own settings, or schedule a contract upgrade. It cannot move funds.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xb0ec3F657ef43A615aB480FA8D5A53BF2c2f05d5#code"
},
{
"name": "RocketDAOProtocolActions",
"isVerified": true,
"address": "eth:0xB50d513de40eE70A662c39207b4382a693f9e08D",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Placeholder action contract for token-holder governance; it exposes no privileged action in this deployment.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xB50d513de40eE70A662c39207b4382a693f9e08D#code"
},
{
"name": "RocketDAOProtocolVerifierV2",
"name": "RocketDAOProtocolVerifier",
"isVerified": true,
"address": "eth:0xc4D85aA3e318c38005F6D73cC53E5A2b4223723a",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Fraud-proof referee for the voting-power trees used by token-holder governance. A proposer stakes 100 collateral tokens on a claimed tree; any address can stake 10 to challenge a node of it, and the proposer must answer within 30m or the proposal is defeated and the bonds are transferred to the challengers. Nobody is trusted to assert the tree; the bonds and the response deadline are what make it binding.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xc4D85aA3e318c38005F6D73cC53E5A2b4223723a#code"
},
{
"name": "RocketDAOProtocolSettingsSecurity",
"isVerified": true,
"address": "eth:0xC9D771AaF504F33bB3C8a7E67eA9f1881F837cFf",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of the security council and of the upgrade path: council quorum and vote, action, and execution windows, the waiting period between an approved upgrade and its application, and the share of the council needed to cancel one. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xC9D771AaF504F33bB3C8a7E67eA9f1881F837cFf#code"
},
{
"name": "RocketDAOProtocol",
"isVerified": true,
"address": "eth:0xCaC25e88276A333cF9d4196d112D93af67ef809A",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Entry point of token-holder governance and the holder of the retired bootstrap powers. While bootstrap mode was engaged the bootstrap account could set any protocol parameter, spend the treasury, and seat or remove security-council members on its own. Bootstrap mode is now permanently disabled, so every one of those functions reverts and the same actions are reachable only through a passed token-holder proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xCaC25e88276A333cF9d4196d112D93af67ef809A#code"
},
{
"name": "RocketDAOProtocolProposals",
"isVerified": true,
"address": "eth:0xcf7F6E23cD8189B7F56b14F66e11241C8ac0F03b",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Executes what token-holder governance has voted for: setting any protocol parameter, splitting the reward inflation between claimant groups, spending the treasury as a one-off or as a recurring payment stream, and seating, removing, or replacing security-council members. It has no upgrade entry point, so token holders cannot change which code the protocol runs.\n* Roles:\n * **tokenHolderVote**: RocketDAOProtocolProposal",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xcf7F6E23cD8189B7F56b14F66e11241C8ac0F03b#code"
},
{
"name": "RocketDAOProtocolVerifier",
"isVerified": true,
"address": "eth:0xd1f7e573cdC64FC0B201ca37aB50bC7Dd880040A",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Fraud-proof referee for the voting-power trees used by token-holder governance. A proposer stakes 100 collateral tokens on a claimed tree; any address can stake 10 to challenge a node of it, and the proposer must answer within 30m or the proposal is defeated and the bonds are transferred to the challengers. Nobody is trusted to assert the tree; the bonds and the response deadline are what make it binding.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xd1f7e573cdC64FC0B201ca37aB50bC7Dd880040A#code"
},
{
"name": "RocketDAONodeTrustedSettingsMembers",
"isVerified": true,
"address": "eth:0xdA1AB39e62E0A5297AF44C7064E501b0613f0D01",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of oracle-set membership: the bond a member must post, the quorum, the cost and timing of a liveness challenge, and the unbonded-validator allowance. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xdA1AB39e62E0A5297AF44C7064E501b0613f0D01#code"
},
{
"name": "RocketDAONodeTrustedSettingsMinipool",
"isVerified": true,
"address": "eth:0xE535fA45e12d748393C117C6D8EEBe1a7D124d95",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters the oracle set applies to validator contracts: the scrub window before funding, whether a scrub is penalised, and the window and quorum for cancelling a bond reduction. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xE535fA45e12d748393C117C6D8EEBe1a7D124d95#code"
},
{
"name": "RocketDAOSecurityActions",
"isVerified": true,
"address": "eth:0xeaa442dF4Bb5394c66C8024eFb4979bEc89Eb59a",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Executes security-council membership changes: accepting an invitation, leaving, and being removed. Invitations and removals originate from token-holder governance.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xeaa442dF4Bb5394c66C8024eFb4979bEc89Eb59a#code"
},
{
"name": "RocketDAOProtocolSettingsProposals",
"isVerified": true,
"address": "eth:0xf6ad771dfB1cd10c66F688E251b5E5c21cbfDF81",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Parameters of token-holder governance: proposal and challenge bonds, the challenge period, the vote delay and the two voting phases, the quorum and veto quorum, and the execution window. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xf6ad771dfB1cd10c66F688E251b5E5c21cbfDF81#code"
},
{
"name": "RocketClaimDAO",
"isVerified": true,
"address": "eth:0xfB2F2Ab63DCf412ced6cdE5f4f809215ed0c81aa",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Treasury spender. It can make a one-off payment or open a recurring payment stream to a named recipient, and it pays out of the custody contract. Only an executed token-holder proposal can create or change a payment; claiming an already-approved balance is permissionless.\n* Roles:\n * **governanceProposals**: RocketDAOProtocolProposals; ultimately RocketDAOProtocolProposal",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xfB2F2Ab63DCf412ced6cdE5f4f809215ed0c81aa#code"
},
{
"name": "DepositContract",
"isVerified": true,
"address": "eth:0x00000000219ab540356cBB839Cbe05303d7705Fa",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Ethereum Beacon Chain deposit contract.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x00000000219ab540356cBB839Cbe05303d7705Fa#code"
},
{
"name": "RocketHotfixNodeFee",
"isVerified": true,
"address": "eth:0x4640b8610f3eFdeb8d44834ADb3228d0E79eaa09",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x4640b8610f3eFdeb8d44834ADb3228d0E79eaa09#code"
},
{
"name": "RocketUpgradeOneDotFour",
"isVerified": true,
"address": "eth:0x5b3B5C76391662e56d0ff72F31B89C409316c8Ba",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5b3B5C76391662e56d0ff72F31B89C409316c8Ba#code"
},
{
"name": "RocketUpgradeOneDotThree",
"isVerified": true,
"address": "eth:0x5dC69083B68CDb5c9ca492A0A5eC581e529fb73C",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x5dC69083B68CDb5c9ca492A0A5eC581e529fb73C#code"
},
{
"name": "RocketUpgradeOneDotFourDissolveHotfix",
"isVerified": true,
"address": "eth:0x91003AD0e47d3B963467A22f2a42F92fdc161d22",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x91003AD0e47d3B963467A22f2a42F92fdc161d22#code"
},
{
"name": "RocketUpgradeOneDotTwo",
"isVerified": true,
"address": "eth:0x9a0b5d3101d111EA0edD573d45ef2208CC97984a",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0x9a0b5d3101d111EA0edD573d45ef2208CC97984a#code"
},
{
"name": "RocketPoolTokenFixedSupply",
"isVerified": true,
"address": "eth:0xB4EFd85c19999D84251304bDA99E90B92300Bd93",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "Superseded fixed-supply ERC-20 (RPL), kept only so holders can still swap into its successor. Its owner can register a sale agent that mints, but minting asserts that total supply stays within the hard cap and 0 of the cap is left, so no further issuance is possible. The registry refuses to repoint this name.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xB4EFd85c19999D84251304bDA99E90B92300Bd93#code"
},
{
"name": "RocketUpgradeOneDotThreeDotOne",
"isVerified": true,
"address": "eth:0xc2C81454427b1E53Fdf5d3B45561e3c18F90f9eD",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xc2C81454427b1E53Fdf5d3B45561e3c18F90f9eD#code"
},
{
"name": "RocketUpgradeOneDotOne",
"isVerified": true,
"address": "eth:0xC680a22b4F03977f69b51A09f3Dbe922eb77C8FE",
"upgradeability": {
"proxyType": "immutable",
"admins": [],
"implementations": [],
"immutable": true
},
"chain": "ethereum",
"description": "One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n",
"discoveryDrivenData": true,
"url": "https://etherscan.io/address/0xC680a22b4F03977f69b51A09f3Dbe922eb77C8FE#code"
}
]
},
"risks": []
}
[
{
"id": "6259540b",
"date": "Wed, 16 Sep 2026 14:20:22 GMT",
"timestamp": 1789568354,
"description": "`rocketDAOProtocolVerifier` re-pointed to a new implementation (version 2 to 3) via oDAO proposal 31 (2026-08-27), executed 2026-09-10 after the 7d delay. It patches a vulnerability in the pDAO voting system: the contract that validates a node's voting-power proof was missing two input bounds (`_nodeIndex < nodeCount` and `_witness.length == depth`), so a node registered after a proposal's snapshot could submit a malformed proof that should have been rejected. The rest of the diff is a 0.8.18 to 0.8.30 compiler bump. Old contract deregistered.\nhttps://disco.l2beat.com/diff/eth:0xd1f7e573cdC64FC0B201ca37aB50bC7Dd880040A/eth:0xc4D85aA3e318c38005F6D73cC53E5A2b4223723a\n\n`node.registration.enabled` set to `true` (security council proposal 32, 2026-09-11): new node operators can register again, after the switch was turned off on 2026-08-19 while the verifier fix was pending.",
"isHighSeverity": false,
"changeCount": 6,
"sections": [
{
"kind": "watched-changes",
"body": "```diff\n contract RocketStorage (eth:0x1d8f8f00cfa6758d7bE78336684788Fb0ee0Fa46) [rocketpool/RocketStorage] {\n +++ description: Eternal-storage registry and the root of the protocol. It holds every protocol variable in typed key-value maps and is the only contract with persistent state; the logic contracts are stateless and read and write through it. Each logic contract is registered under the hash of its name, so repointing a name in a single write moves every caller to a new implementation on its next call. Write access is limited to addresses flagged as registered contracts, which means the registry itself imposes no delay: any delay comes from the contract performing the write. Registered names are not enumerable on-chain, so discovery resolves each one by calling the address lookup with its name hash.\n values.rocketDAOProtocolVerifier:\n- \"eth:0xd1f7e573cdC64FC0B201ca37aB50bC7Dd880040A\"\n+ \"eth:0xc4D85aA3e318c38005F6D73cC53E5A2b4223723a\"\n }\n```\n\n```diff\n contract RocketDAONodeTrustedUpgrade (eth:0x9290AA076a2F1418a4E414E3D83AE03cA8E1ad10) [rocketpool/RocketDAONodeTrustedUpgrade] {\n +++ description: The only path that changes which code the protocol runs. A passed oracle-set proposal records a pending change here rather than applying it; the change becomes applicable after 7d and, until then, the security council can cancel it. Once the delay has run and the change was not cancelled, any oracle-set member applies it. A fixed list of names is refused outright: the custody contract, the token contracts, the beacon-chain deposit contract, and the penalty-cap contract. Registering an entirely new name is allowed and grants that address write access to the registry, which is how the exclusion list is worked around. The bootstrap account had an immediate path here; it is permanently closed.\n values.pendingUpgradeExecuted.1:\n- false\n+ true\n }\n```\n\n```diff\n contract RocketDAOProtocolSettingsNode (eth:0xb02B883303e658Ddcd58D3871Dc4Ca0C91f0fc9D) [rocketpool/RocketDAOProtocolSettingsNode] {\n +++ description: Parameters for node operators: whether registration and node deposits are enabled, bond sizes, the minimum collateral stake, the unstaking waiting period, and the cap on stake that counts toward voting power. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n values.getRegistrationEnabled:\n- false\n+ true\n }\n```\n\n```diff\n contract RocketNodeManager (eth:0xcf2d76A7499d3acB5A22ce83c027651e8d76e250) [rocketpool/RocketNodeManager] {\n +++ description: Register of node operators. It records registration, the operator's withdrawal address for ETH and for the collateral token, timezone, smoothing-pool membership, and the address of the operator's pooled validator contract. Changing a withdrawal address is a two-step confirm, so a mistyped address cannot strand the operator. New registrations are currently true.\n description:\n- \"Register of node operators. It records registration, the operator's withdrawal address for ETH and for the collateral token, timezone, smoothing-pool membership, and the address of the operator's pooled validator contract. Changing a withdrawal address is a two-step confirm, so a mistyped address cannot strand the operator. New registrations are currently false.\"\n+ \"Register of node operators. It records registration, the operator's withdrawal address for ETH and for the collateral token, timezone, smoothing-pool membership, and the address of the operator's pooled validator contract. Changing a withdrawal address is a two-step confirm, so a mistyped address cannot strand the operator. New registrations are currently true.\"\n+++ description: True when a new operator may register.\n values.registrationState:\n- false\n+ true\n }\n```\n\n```diff\n- Status: DELETED\n contract RocketDAOProtocolVerifier (eth:0xd1f7e573cdC64FC0B201ca37aB50bC7Dd880040A) [rocketpool/RocketDAOProtocolVerifier]\n +++ description: Fraud-proof referee for the voting-power trees used by token-holder governance. A proposer stakes 100 collateral tokens on a claimed tree; any address can stake 10 to challenge a node of it, and the proposer must answer within 30m or the proposal is defeated and the bonds are transferred to the challengers. Nobody is trusted to assert the tree; the bonds and the response deadline are what make it binding.\n```"
}
]
},
{
"id": "f93f30fd",
"date": "Tue, 08 Sep 2026 11:13:13 GMT",
"timestamp": 1788817670,
"description": "Initial discovery of Rocket Pool. RocketStorage is the only seed; every other contract is resolved from its name hash in that registry.",
"isHighSeverity": false,
"changeCount": 79,
"sections": [
{
"kind": "initial-discovery",
"body": "```diff\n+ Status: CREATED\n contract DepositContract (eth:0x00000000219ab540356cBB839Cbe05303d7705Fa) [global/DepositContract]\n +++ description: Ethereum Beacon Chain deposit contract.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedActions (eth:0x029d946F28F93399a5b0D09c879FC8c94E596AEb) [rocketpool/RocketDAONodeTrustedActions]\n +++ description: Executes the membership changes the oracle set has voted for: accepting an invitation against a posted bond, leaving and reclaiming the bond, being removed with an optional fine, and the challenge process that removes a member who stops responding.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolDelegate (eth:0x03d30466d199Ef540823fe2a22CAE2E3b9343bb0) [rocketpool/RocketMinipoolDelegate]\n +++ description: Shared implementation behind every legacy validator contract. It holds the operator's bond and the matched pooled ETH, tracks the validator's lifecycle, and splits withdrawals between the operator and the pool by the commission recorded at creation. Distributing the contract's balance is open to any caller while the validator is staking; only distributing an already-dissolved contract is restricted to the operator. An absent operator therefore cannot hold the pooled share.\n```\n\n```diff\n+ Status: CREATED\n contract RocketAuctionManager (eth:0x1a2F00D187C9388fDa3Bf2dc46a6b4740849EcCE) [rocketpool/RocketAuctionManager]\n +++ description: Dutch auction that sells collateral tokens seized from node operators back for ETH, returning the ETH to the pool. Lot creation and bidding are permissionless when their flags are on, and the price decays from a governed starting ratio to a governed reserve ratio over a fixed number of blocks. Both flags are on the security council's allowlist.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMegapoolProxy (eth:0x1B389D76a04d01026c5f5B0a125D4CCF26F9cd51) [rocketpool/RocketMegapoolProxy]\n +++ description: Proxy base each node operator's pooled validator contract runs. It delegates to the shared implementation resolved from the registry; the operator chooses whether to track the latest implementation or stay on the current one, within an expiry after which tracking resumes. The copy registered here is the uninitialised template.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsInflation (eth:0x1d4AAEaE7C8b75a8e5ab589a84516853DBDdd735) [rocketpool/RocketDAOProtocolSettingsInflation]\n +++ description: Parameters of collateral-token issuance: the per-interval rate and the start time of the first interval. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketStorage (eth:0x1d8f8f00cfa6758d7bE78336684788Fb0ee0Fa46) [rocketpool/RocketStorage]\n +++ description: Eternal-storage registry and the root of the protocol. It holds every protocol variable in typed key-value maps and is the only contract with persistent state; the logic contracts are stateless and read and write through it. Each logic contract is registered under the hash of its name, so repointing a name in a single write moves every caller to a new implementation on its next call. Write access is limited to addresses flagged as registered contracts, which means the registry itself imposes no delay: any delay comes from the contract performing the write. Registered names are not enumerable on-chain, so discovery resolves each one by calling the address lookup with its name hash.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkBalances (eth:0x1D9F14C6Bfd8358b589964baD8665AdD248E9473) [rocketpool/RocketNetworkBalances]\n +++ description: Balance oracle. Members of the oracle set submit the network's total ETH, its staked ETH, and the liquid staking token supply for a block; a report is written once submissions reach 51% of the set, and anyone can finalise a report that has already reached that share. The liquid staking token divides the two written values to get its redemption price, so this is the contract that sets that price. Three bounds apply: a report may not land until almost a full reporting interval of 1d has passed since the last one, the price may move by at most 2% per report, and reporting can be switched off by the setting below. Nothing here expires: if reporting stops, the last report stands indefinitely and the price stops tracking validator rewards.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProposal (eth:0x1e94e6131Ba5B4F193d2A1067517136C52ddF102) [rocketpool/RocketDAOProposal]\n +++ description: Shared proposal store for the two member-based bodies, the oracle set and the security council. It records the payload, the vote counts, and the schedule, and executes the payload against the proposing body once the vote count reaches the required threshold. A proposal becomes executable the instant it reaches its threshold, so the voting window is an upper bound, not a delay.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsDeposit (eth:0x227BE8dD01DF8ad9BED0178e4F8cEC2996C5c365) [rocketpool/RocketDAOProtocolSettingsDeposit]\n +++ description: Parameters of the user deposit path: whether deposits and assignment are enabled, the minimum deposit, the pool size cap, the deposit fee, and how many validators one deposit may fund. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkPrices (eth:0x25E54Bf48369b8FB25bB79d3a3Ff7F3BA448E382) [rocketpool/RocketNetworkPrices]\n +++ description: Price oracle for the collateral token. Members of the oracle set submit a price for a block and it is written once submissions reach the network consensus share; anyone can finalise a report that already has that share. The price governs how much collateral a node operator must hold and what its stake is worth in auctions; it does not enter the liquid staking token's redemption price. Reporting can be switched off by a governed setting.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolProposal (eth:0x2D627A50Dc1C4EDa73E42858E8460b0eCF300b25) [rocketpool/RocketDAOProtocolProposal]\n +++ description: Voting machine for token-holder governance. Voting power is proven optimistically: a proposer posts a bond and a claimed voting-power tree, which anyone can challenge within a challenge window by posting their own bond, and an unanswered challenge defeats the proposal and forfeits the proposer's bond. Voting runs in two phases; a proposal needs 15% support to pass and can be blocked by 20% of voting power voting against it outright. A passed proposal has 28d to execute.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOSecurityProposals (eth:0x334B9B1a6F9d7531efb13746482ff40f1c2a0c4e) [rocketpool/RocketDAOSecurityProposals]\n +++ description: Proposal front end for the security council, limited to an explicit allowlist of settings. Every write checks a per-setting allow flag in the registry and reverts if it is not set, so the council can only touch keys that token-holder governance has opened to it; which keys are open is registry state, read from the chain at discovery time as one flag per setting. A numeric setting on the list is additionally capped by the executing code. A proposal here becomes executable the moment it reaches quorum, with no delay of its own.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNodeDistributorDelegate (eth:0x35A85d4c115801395e6E3abAa784Fb05826f129D) [rocketpool/RocketNodeDistributorDelegate]\n +++ description: Shared implementation behind each node operator's fee-splitting proxy. Distribution is permissionless and pays the operator and the pool by the split recorded on-chain; nobody can redirect a share.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsAuction (eth:0x364F989A3C9a1F66cB51b9043680974eA08C0d18) [rocketpool/RocketDAOProtocolSettingsAuction]\n +++ description: Parameters of the collateral auction: whether lots may be created and bid on, lot size bounds, duration, and the starting and reserve price ratios. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketVault (eth:0x3bDC69C4E5e13E52A65f5583c23EFB9636b469d6) [rocketpool/RocketVault]\n +++ description: Custody contract for the protocol's pooled ETH and ERC-20 balances. Balances are booked against the *name* of the registered contract that deposited them, and a registered contract can only withdraw, transfer, or burn against its own name; anyone can deposit. The registry refuses to repoint this name, so the address holding the funds cannot be changed, but a contract that is upgraded inherits the balance booked to the name it replaced.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsMegapool (eth:0x40628FAAc22383327b9f7bBc86CD1857050A2dCe) [rocketpool/RocketDAOProtocolSettingsMegapool]\n +++ description: Parameters of the pooled validator contracts: penalty ceiling and threshold, dissolve timing and penalty, late-notification fine, and the delays after which anyone may distribute. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract AddressQueueStorage (eth:0x44E31944E1A6F3b8F805E105B130F8bdb7E2EBd8) [rocketpool/AddressQueueStorage]\n +++ description: FIFO queue of addresses kept in the shared registry, with a capacity bound per queue. Only registered contracts can write.\n```\n\n```diff\n+ Status: CREATED\n contract RocketHotfixNodeFee (eth:0x4640b8610f3eFdeb8d44834ADb3228d0E79eaa09) [rocketpool/RocketHotfixNodeFee]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract LinkedListStorage (eth:0x52590E8aaC140E2020f8F51695719922ebcCb6D6) [rocketpool/LinkedListStorage]\n +++ description: Doubly linked list kept in the shared registry, used for queues that must support removal from the middle. Only registered contracts can write.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolBase (eth:0x560656C8947564363497E9C78A8BDEff8d3EFF33) [rocketpool/RocketMinipoolBase]\n +++ description: Proxy base every legacy validator contract runs. It delegates to a shared implementation resolved from the registry; the validator's owner chooses whether to track the latest implementation or pin the one they upgraded to, and can roll back one version. The copy registered here is the uninitialised template, so its own slots are empty.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkSnapshotsTime (eth:0x569F5b3024054AB4049A50df223a747AFE18a891) [rocketpool/RocketNetworkSnapshotsTime]\n +++ description: Timestamp-indexed history of protocol values, used for the rolling windows that bound penalties. Only registered contracts can append, and entries are append-only.\n```\n\n```diff\n+ Status: CREATED\n contract RocketUpgradeOneDotFour (eth:0x5b3B5C76391662e56d0ff72F31B89C409316c8Ba) [rocketpool/RocketUpgradeOneDotFour]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract RocketUpgradeOneDotThree (eth:0x5dC69083B68CDb5c9ca492A0A5eC581e529fb73C) [rocketpool/RocketUpgradeOneDotThree]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsNetwork (eth:0x67Fd03a5095197D1aD1F932BC55E022C420b1153) [rocketpool/RocketDAOProtocolSettingsNetwork]\n +++ description: Network-wide parameters: the oracle consensus share, reporting frequencies and switches, the cap on how far the redemption price may move per report, the commission bounds and demand range, the revenue split, and the target redemption buffer. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNodeDeposit (eth:0x6B13698c306a297Fee1383cdC2c65d63781D2D47) [rocketpool/RocketNodeDeposit]\n +++ description: Takes a node operator's own ETH bond and creates the validator that the pooled deposit is matched against. The bond size is fixed by governed settings, and the operator's ETH and the pooled ETH are held by the validator contract, not by the operator.\n```\n\n```diff\n+ Status: CREATED\n contract SecurityCouncilSafe (eth:0x6C565aF34f15dE064b56afEdF7B0F59C15bB20FE) [GnosisSafe]\n +++ description: None\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedSettingsRewards (eth:0x7322c24752f79c05FFD1E2a6FCB97020C1C264F1) [rocketpool/RocketDAONodeTrustedSettingsRewards]\n +++ description: Per-network switches for where reward claims may be directed. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolFactory (eth:0x7B8c48256CaF462670f84c7e849cab216922B8D3) [rocketpool/RocketMinipoolFactory]\n +++ description: Deploys legacy validator contracts as minimal proxies at addresses derived from the operator address and a salt, so the address is known before deployment. Only a registered contract can deploy one.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOSecurity (eth:0x84aE6D61Df5c6ba7196b5C76Bcb112B8a689aD37) [rocketpool/RocketDAOSecurity]\n +++ description: Membership register for the security council. Seats currently filled: 1. Each seat carries one vote and a proposal passes once votes for it reach 0.51. Members post no bond. Membership is set by RPL governance, not by the council itself.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsRewards (eth:0x8857610Ba0A7caFD4dBE1120bfF03E9c74fc4124) [rocketpool/RocketDAOProtocolSettingsRewards]\n +++ description: Parameters of the reward periods: the period length, the number of periods in a claim interval, and the split of issuance between node operators, the oracle set, and the treasury. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketUpgradeOneDotFourDissolveHotfix (eth:0x91003AD0e47d3B963467A22f2a42F92fdc161d22) [rocketpool/RocketUpgradeOneDotFourDissolveHotfix]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedUpgrade (eth:0x9290AA076a2F1418a4E414E3D83AE03cA8E1ad10) [rocketpool/RocketDAONodeTrustedUpgrade]\n +++ description: The only path that changes which code the protocol runs. A passed oracle-set proposal records a pending change here rather than applying it; the change becomes applicable after 7d and, until then, the security council can cancel it. Once the delay has run and the change was not cancelled, any oracle-set member applies it. A fixed list of names is refused outright: the custody contract, the token contracts, the beacon-chain deposit contract, and the penalty-cap contract. Registering an entirely new name is allowed and grants that address write access to the registry, which is how the exclusion list is worked around. The bootstrap account had an immediate path here; it is permanently closed.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOSecurityUpgrade (eth:0x950BaF0358164339114914169BF16754789B5Dc4) [rocketpool/RocketDAOSecurityUpgrade]\n +++ description: Veto lever over pending contract changes. A council member proposes a veto against a change that is still inside its waiting period; the veto passes at 33% of the council's seats and takes effect as soon as it reaches that threshold, so it always lands inside the window. A vetoed change can never be applied. This contract can only cancel changes; it cannot make one.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkVoting (eth:0x994A9C49230FEC0c127B8F42D6c5288F02610AeD) [rocketpool/RocketNetworkVoting]\n +++ description: Computes an address's voting power at a past block from its staked collateral and its share of the validator bond, and records vote delegation. It reads the snapshot history rather than holding balances of its own.\n```\n\n```diff\n+ Status: CREATED\n contract RocketUpgradeOneDotTwo (eth:0x9a0b5d3101d111EA0edD573d45ef2208CC97984a) [rocketpool/RocketUpgradeOneDotTwo]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkRevenues (eth:0x9D9708dA8E0200Dd8Dd9ad09e0AAf184Ad260842) [rocketpool/RocketNetworkRevenues]\n +++ description: Time-weighted record of how staking revenue is split between node operators, the depositors, and the governance voter share. Only a registered pooled validator contract or the security-council proposal contract can write here, and the council's write is bounded by the guardrails checked in that contract.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolQueue (eth:0x9e966733e3E9BFA56aF95f762921859417cF6FaA) [rocketpool/RocketMinipoolQueue]\n +++ description: Queue of legacy validator contracts waiting for pooled ETH. Entry and exit are driven by registered contracts only.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMegapoolPenalties (eth:0xa2afC3C2d8ea4eBdbE925cADe17c29517630e6aB) [rocketpool/RocketMegapoolPenalties]\n +++ description: Penalty voting for the pooled per-node validator contracts. Members of the oracle set submit an ETH amount against one node's contract; it is applied once submissions reach 51% of the set. Each penalty is capped at 612 ETH, and the same cap is enforced as a running total over a rolling window whose length is a constant in the contract's code. A penalty reduces the node operator's share, not the pooled depositors'.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolStatus (eth:0xa52451b9d25EEf02BE42B3A8161A18f947F8A6a5) [rocketpool/RocketMinipoolStatus]\n +++ description: Oracle-set entry point for marking a legacy validator contract withdrawable and for scrubbing one whose withdrawal credentials do not match before it is funded. The scrub window is a governed setting and is the check that stops an operator pointing pooled ETH at credentials they control.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedSettingsProposals (eth:0xAD038f8994a6bd51C8A72D3721CEd83401D4d2b0) [rocketpool/RocketDAONodeTrustedSettingsProposals]\n +++ description: Parameters of oracle-set proposals: the cooldown between one member's proposals, the delay before voting opens, the voting window, and the execution window. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketTokenRETH (eth:0xae78736Cd615f374D3085123A210448E74Fc6393) [rocketpool/RocketTokenRETH]\n +++ description: Liquid staking token (rETH). Minting is restricted to the deposit-pool contract. Burning is open to any holder with no admin gate and no pause switch, but it pays out only from the ETH held here plus the deposit pool's unassigned surplus, so large redemptions depend on that buffer rather than on the staked balance. The redemption price is the ratio of two values written by the balance oracle, so this contract asserts no price of its own and has no staleness check. Governance targets a buffer of 1% of the token's backing. Transfers are blocked for a configured number of blocks after the holder deposits, currently 0. The registry refuses to repoint this name, so the token address is fixed.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsMinipool (eth:0xaeF94C3650AA13d7A2456477fc374a16b94B9152) [rocketpool/RocketDAOProtocolSettingsMinipool]\n +++ description: Parameters of the legacy validator contracts: launch timeout, bond-reduction and withdrawable-submission switches, and the window in which anyone may distribute. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsNode (eth:0xb02B883303e658Ddcd58D3871Dc4Ca0C91f0fc9D) [rocketpool/RocketDAOProtocolSettingsNode]\n +++ description: Parameters for node operators: whether registration and node deposits are enabled, bond sizes, the minimum collateral stake, the unstaking waiting period, and the cap on stake that counts toward voting power. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedProposals (eth:0xb0ec3F657ef43A615aB480FA8D5A53BF2c2f05d5) [rocketpool/RocketDAONodeTrustedProposals]\n +++ description: Proposal front end for the oracle set. Only a seated member can propose, and only after a per-member cooldown; voting opens after a delay and runs for a fixed window, with one vote per member. A passed proposal can invite, remove, or fine a member, change the oracle set's own settings, or schedule a contract upgrade. It cannot move funds.\n```\n\n```diff\n+ Status: CREATED\n contract RocketPoolTokenFixedSupply (eth:0xB4EFd85c19999D84251304bDA99E90B92300Bd93) [rocketpool/RocketPoolToken]\n +++ description: Superseded fixed-supply ERC-20 (RPL), kept only so holders can still swap into its successor. Its owner can register a sale agent that mints, but minting asserts that total supply stays within the hard cap and 0 of the cap is left, so no further issuance is possible. The registry refuses to repoint this name.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolActions (eth:0xB50d513de40eE70A662c39207b4382a693f9e08D) [rocketpool/RocketDAOProtocolActions]\n +++ description: Placeholder action contract for token-holder governance; it exposes no privileged action in this deployment.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrusted (eth:0xb8e783882b11Ff4f6Cef3C501EA0f4b960152cc9) [rocketpool/RocketDAONodeTrusted]\n +++ description: Membership register for the oracle set: the permissioned group that reports the network balances, the collateral price, and the rewards tree, votes on penalties, and is the only body that can approve a contract upgrade. Seats currently filled: 10. Each seat carries one vote and a proposal passes once votes for it reach 5.1. Membership is bonded: joining locks 1,750 collateral tokens, which a passed kick proposal can fine. The bootstrap account could once seat members directly; that path is permanently closed.\n```\n\n```diff\n+ Status: CREATED\n contract RocketUpgradeOneDotThreeDotOne (eth:0xc2C81454427b1E53Fdf5d3B45561e3c18F90f9eD) [rocketpool/RocketUpgradeOneDotThreeDotOne]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolVerifierV2 (eth:0xc4D85aA3e318c38005F6D73cC53E5A2b4223723a) [rocketpool/RocketDAOProtocolVerifier]\n +++ description: Fraud-proof referee for the voting-power trees used by token-holder governance. A proposer stakes 100 collateral tokens on a claimed tree; any address can stake 10 to challenge a node of it, and the proposer must answer within 30m or the proposal is defeated and the bonds are transferred to the challengers. Nobody is trusted to assert the tree; the bonds and the response deadline are what make it binding.\n```\n\n```diff\n+ Status: CREATED\n contract RocketUpgradeOneDotOne (eth:0xC680a22b4F03977f69b51A09f3Dbe922eb77C8FE) [rocketpool/RocketUpgradeOneDotOne]\n +++ description: One-shot migration job. It was registered as a protocol contract so that it could write to the shared registry, ran once, and latched a flag that makes a second run revert. It is still registered, so it still holds registry write access, but every entry point it exposes is now either gated by that flag or bounded to repairing existing bookkeeping.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsSecurity (eth:0xC9D771AaF504F33bB3C8a7E67eA9f1881F837cFf) [rocketpool/RocketDAOProtocolSettingsSecurity]\n +++ description: Parameters of the security council and of the upgrade path: council quorum and vote, action, and execution windows, the waiting period between an approved upgrade and its application, and the share of the council needed to cancel one. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMegapoolDelegate (eth:0xca3DD4bee7C174903dBF66c3897c27E9ADaAEBdD) [rocketpool/RocketMegapoolDelegate]\n +++ description: Shared implementation behind every node operator's pooled validator contract. One contract holds many validators for one operator, keeping the operator bond and the matched pooled ETH separate in its accounting. Exits and final balances are proven against beacon-chain state rather than asserted by a reporter. Splitting the balance is open to any caller; only moving the operator's own share out is restricted to the operator, so an absent operator cannot withhold the pooled share.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocol (eth:0xCaC25e88276A333cF9d4196d112D93af67ef809A) [rocketpool/RocketDAOProtocol]\n +++ description: Entry point of token-holder governance and the holder of the retired bootstrap powers. While bootstrap mode was engaged the bootstrap account could set any protocol parameter, spend the treasury, and seat or remove security-council members on its own. Bootstrap mode is now permanently disabled, so every one of those functions reverts and the same actions are reachable only through a passed token-holder proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketRewardsPool (eth:0xCba5951fc706Fc783b7C142DaE8576Ebe29c41FD) [rocketpool/RocketRewardsPool]\n +++ description: Accrues the token inflation and the pooled ETH rewards for each reward period and records the tree that splits them. A period is closed when submissions from the oracle set reach the network consensus share; anyone can finalise a submission that already has it. The tree itself is computed off-chain, so the oracle set is trusted for its contents; the totals it can distribute are bounded by what has accrued.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDepositPool (eth:0xCE15294273CFb9D9b628F4D61636623decDF4fdC) [rocketpool/RocketDepositPool]\n +++ description: Entry point for user deposits and the queue that matches them to validators. A deposit is permissionless while the deposit flag is on; it must be at least 0.01 ETH, must leave the pool within the 6,000,000 ETH cap after queue assignments, pays a fee of 0.05% of the amount, and mints the liquid staking token for the remainder. Deposited ETH is held by the custody contract under this contract's name until it is assigned to a validator or withdrawn back as redemption collateral.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNodeManager (eth:0xcf2d76A7499d3acB5A22ce83c027651e8d76e250) [rocketpool/RocketNodeManager]\n +++ description: Register of node operators. It records registration, the operator's withdrawal address for ETH and for the collateral token, timezone, smoothing-pool membership, and the address of the operator's pooled validator contract. Changing a withdrawal address is a two-step confirm, so a mistyped address cannot strand the operator. New registrations are currently false.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolProposals (eth:0xcf7F6E23cD8189B7F56b14F66e11241C8ac0F03b) [rocketpool/RocketDAOProtocolProposals]\n +++ description: Executes what token-holder governance has voted for: setting any protocol parameter, splitting the reward inflation between claimant groups, spending the treasury as a one-off or as a recurring payment stream, and seating, removing, or replacing security-council members. It has no upgrade entry point, so token holders cannot change which code the protocol runs.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolVerifier (eth:0xd1f7e573cdC64FC0B201ca37aB50bC7Dd880040A) [rocketpool/RocketDAOProtocolVerifier]\n +++ description: Fraud-proof referee for the voting-power trees used by token-holder governance. A proposer stakes 100 collateral tokens on a claimed tree; any address can stake 10 to challenge a node of it, and the proposer must answer within 30m or the proposal is defeated and the bonds are transferred to the challengers. Nobody is trusted to assert the tree; the bonds and the response deadline are what make it binding.\n```\n\n```diff\n+ Status: CREATED\n contract RocketTokenRPL (eth:0xD33526068D116cE69F19A9ee46F0bd304F21A51f) [rocketpool/RocketTokenRPL]\n +++ description: Inflationary collateral and governance token (RPL). New supply is issued by a permissionless call that mints the accrued amount to the rewards contract at a fixed rate of 1.0001336806171135 per interval of 1d; there is no privileged minter and no cap. It also swaps a fixed-supply predecessor token in at one to one, burning the token received. The registry refuses to repoint this name.\n```\n\n```diff\n+ Status: CREATED\n contract AddressSetStorage (eth:0xD4ae2511dF21F367792bA4D67c6eb032171c6a16) [rocketpool/AddressSetStorage]\n +++ description: Set of addresses with O(1) membership, index lookup, and removal, kept in the shared registry. Only registered contracts can write.\n```\n\n```diff\n+ Status: CREATED\n contract RocketSmoothingPool (eth:0xd4E96eF8eee8678dBFf4d535E033Ed1a4F7605b7) [rocketpool/RocketSmoothingPool]\n +++ description: Holds the block-proposal income of operators who opted into pooled rewards. It only accepts ETH and lets a registered contract withdraw it; the split back to operators is decided by the periodic rewards tree, not here.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMegapoolFactory (eth:0xD5bffeaa9f373B9C367132772FAA0b88e3F0E38b) [rocketpool/RocketMegapoolFactory]\n +++ description: Deploys one pooled validator contract per node operator, at an address derived from the operator address, and holds the implementation those proxies delegate to.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedSettingsMembers (eth:0xdA1AB39e62E0A5297AF44C7064E501b0613f0D01) [rocketpool/RocketDAONodeTrustedSettingsMembers]\n +++ description: Parameters of oracle-set membership: the bond a member must post, the quorum, the cost and timing of a liveness challenge, and the unbonded-validator allowance. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolBondReducer (eth:0xDe8Ab526b19FCA2D5a57c4A78b698041717BE591) [rocketpool/RocketMinipoolBondReducer]\n +++ description: Lets a node operator lower the bond on an existing legacy validator, inside a governed window and only while the feature flag is on. A quorum of the oracle set can cancel a pending reduction during the window, which is the check against an operator reducing their own exposure without exiting.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNodeDistributorFactory (eth:0xe228017f77B3E0785e794e4c0a8A6b935bB4037C) [rocketpool/RocketNodeDistributorFactory]\n +++ description: Deploys one minimal proxy per node operator, at an address derived from the operator's address, to split the fee-recipient income of that operator's legacy validators between the operator and the pool. The proxy code is fixed in this contract.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkSnapshots (eth:0xe37F2d9dFb7397caF671DF5190a5dFB601028f17) [rocketpool/RocketNetworkSnapshots]\n +++ description: Block-indexed history of protocol values, used so a vote can be settled against the state at the block a proposal was made. Only registered contracts can append, and entries are append-only.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMerkleDistributorMainnet (eth:0xE4E2612EE8d7fdc8518Faea85770A3b9c886E2f5) [rocketpool/RocketMerkleDistributorMainnet]\n +++ description: Claim contract for the periodic rewards tree. Anyone can claim on behalf of a node operator with a valid proof, and the proceeds always go to that operator's recorded withdrawal address, so a claim cannot be redirected. Roots are relayed only by the rewards contract.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAONodeTrustedSettingsMinipool (eth:0xE535fA45e12d748393C117C6D8EEBe1a7D124d95) [rocketpool/RocketDAONodeTrustedSettingsMinipool]\n +++ description: Parameters the oracle set applies to validator contracts: the scrub window before funding, whether a scrub is penalised, and the window and quorum for cancelling a bond reduction. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolManager (eth:0xe54B8C641fd96dE5D6747f47C19964c6b824D62C) [rocketpool/RocketMinipoolManager]\n +++ description: Register of the legacy one-validator-per-contract deployments: creation, status counts, public-key mapping, and destruction. Individual validator contracts are not listed here because there are tens of thousands of them and they share one implementation.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMinipoolPenalty (eth:0xE64AC47b6e2FEcfCDEA35147Fe61af9894A06ba6) [rocketpool/RocketMinipoolPenalty]\n +++ description: Cap on how much of a legacy validator contract's rewards the oracle set's penalty vote can divert. The cap lives in this contract's own storage rather than in the registry, deliberately putting it out of the oracle set's reach, and the registry refuses to repoint this name. Only the bootstrap account can change it, with no delay and no upper bound in the code. The effective penalty for a validator contract is the smaller of the cap and the voted rate, so a cap of zero disables legacy penalties entirely. The cap currently reads 0%.\n```\n\n```diff\n+ Status: CREATED\n contract BeaconStateVerifier (eth:0xE9a114c50f26001443B91079Ab5573a90D2D8469) [rocketpool/BeaconStateVerifier]\n +++ description: Verifies Merkle proofs against beacon-chain state roots obtained from the consensus-layer block-root precompile. It has no owner and no configurable trust root, so validator lifecycle facts are proven rather than reported.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOSecurityActions (eth:0xeaa442dF4Bb5394c66C8024eFb4979bEc89Eb59a) [rocketpool/RocketDAOSecurityActions]\n +++ description: Executes security-council membership changes: accepting an invitation, leaving, and being removed. Invitations and removals originate from token-holder governance.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkPenalties (eth:0xeD0493DE30e82bE7C16C8925C7204CE9D1136B3a) [rocketpool/RocketNetworkPenalties]\n +++ description: Penalty voting for the legacy per-validator contracts. Members of the oracle set submit a penalty against one validator contract and a rate is recorded once submissions reach the governed share. The effect is capped separately by the penalty-cap contract, which is outside this registry's reach.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNodeStaking (eth:0xedFc7DCaE43fF954577a2875a9D805874490eE3E) [rocketpool/RocketNodeStaking]\n +++ description: Holds node operators' collateral-token stake. Staking and unstaking are open to the operator or their designated collateral withdrawal address; unstaking is a two-step withdrawal with a 28d waiting period. The stake is not inert: any registered contract can lock, burn, or transfer it, and a legacy validator contract can slash it, so an operator's collateral is exposed to whatever code is registered at those names.\n```\n\n```diff\n+ Status: CREATED\n contract RocketMegapoolManager (eth:0xf2CCd522Ba5fFEda28fe0389963845D61F342034) [rocketpool/RocketMegapoolManager]\n +++ description: Global index of validators across all pooled validator contracts, and the entry point for the beacon-state proofs that record a validator staking, exiting, or failing to exit. Anyone can submit a valid proof; the checks are cryptographic, not permissioned.\n```\n\n```diff\n+ Status: CREATED\n contract RocketDAOProtocolSettingsProposals (eth:0xf6ad771dfB1cd10c66F688E251b5E5c21cbfDF81) [rocketpool/RocketDAOProtocolSettingsProposals]\n +++ description: Parameters of token-holder governance: proposal and challenge bonds, the challenge period, the vote delay and the two voting phases, the quorum and veto quorum, and the execution window. Values live in the shared registry, not here; this contract is the typed accessor and the only writer is a passed governance proposal.\n```\n\n```diff\n+ Status: CREATED\n contract RocketNetworkFees (eth:0xf824e2d69dc7e7c073162C2bdE87dA4746d27a0f) [rocketpool/RocketNetworkFees]\n +++ description: Derives the commission a new validator is created with from how full the deposit pool is relative to a governed demand range, between a governed minimum and maximum. It is pure arithmetic over governed settings; nobody sets the number directly.\n```\n\n```diff\n+ Status: CREATED\n contract RocketClaimDAO (eth:0xfB2F2Ab63DCf412ced6cdE5f4f809215ed0c81aa) [rocketpool/RocketClaimDAO]\n +++ description: Treasury spender. It can make a one-off payment or open a recurring payment stream to a named recipient, and it pays out of the custody contract. Only an executed token-holder proposal can create or change a payment; claiming an already-approved balance is permissionless.\n```"
}
]
}
]