{
"badges": [],
"description": "ether.fi is a liquid staking and restaking protocol. Deposit ETH for eETH (rebasing) or its wrapper weETH, and the pool stakes it both through ether.fi's own permissioned operators and through third-party liquid staking tokens it accepts, with restaking in EigenLayer. A 3-of-3 committee sets the exchange rate under hard caps of at most 0.25% per report. To exit, holders burn eETH for a withdrawal NFT the oracle must finalize, or swap instantly through a buffer for a fee up to 5%, though only a small buffer is instantly liquid, so large exits wait for validators to unwind. Upgrades and roles sit behind a 10 days timelock, with multisigs for day-to-day pausing and parameters.",
"detailedDescription": "ether.fi is a liquid staking and restaking protocol for ETH. Deposit ETH for eETH (rebasing) or its wrapper weETH, and the pool stakes it both through its own permissioned operators and through third-party liquid staking tokens it accepts. Operators are whitelisted, a committee sets the exchange rate, and privileged functions are controlled by multisigs behind timelocks.\n\n\n\n### The exchange rate\n\nA 3-of-3 oracle committee reports staking rewards and EtherFiAdmin applies them. Hard caps bound every report: at most 0.25% up per report and 5% implied APR, with negative moves capped tighter. Each report executes only after a delay of 10 minutes past consensus, in which the operating multisig can cancel it.\n\n### Custody and exit\n\neETH is a staking aggregator rather than a single validator set. ETH deposits fund new compounding validators of 1901 ETH each, run by ether.fi's permissioned operators. Their withdrawal credentials are fixed in code to a protocol-controlled address, the EigenLayer pod of the ether.fi node they belong to or, for a node created without a pod, the node contract itself, so operators run the keys but cannot redirect the stake. The Liquifier accepts already-staked liquid staking tokens from other providers against a governance-set whitelist and mints eETH for them, and EtherFiRestaker can hold them, restake them in EigenLayer, or unwind them to ETH through the provider's own exit. To exit, burn eETH for a withdrawal NFT that the oracle must finalize before the pool pays, or swap instantly through a buffer for a fee up to 5%. On-chain finalization depends on the 3-of-3 committee, and the permissionless stale-oracle backstop only opens if the committee stops reporting entirely. Only a small buffer is instantly liquid, so large exits wait for validators to unwind.\n\n\n\n### Who holds the keys\n\nUpgrades and every role grant sit behind a 10 days timelock. A shorter 2 days timelock and a set of multisigs run day-to-day operations: pausing, blacklisting, approving operators, and tuning parameters within fixed ceilings.",
"description": "ether.fi is a liquid staking protocol. Deposit ETH for eETH (rebasing) or its wrapper weETH, and the pool stakes it both through ether.fi's own permissioned operators, whose validators withdraw to EigenLayer pods, and through third-party liquid staking tokens it accepts. A 3-of-3 committee sets the exchange rate under hard caps of at most 0.25% per report. To exit, holders burn eETH for a withdrawal NFT the oracle must finalize, or swap instantly through a buffer for a fee up to 5%, though only a small buffer is instantly liquid, so large exits wait for validators to unwind. Upgrades and roles sit behind a 10 days timelock, with multisigs for day-to-day pausing and parameters.",
"detailedDescription": "ether.fi is a liquid staking protocol for ETH. Deposit ETH for eETH (rebasing) or its wrapper weETH, and the pool stakes it both through its own permissioned operators and through third-party liquid staking tokens it accepts. Operators are approved by a multisig and start running validators only after a timelock, a committee sets the exchange rate, and privileged functions are controlled by multisigs behind timelocks.\n\n\n\n### The exchange rate\n\nA 3-of-3 oracle committee reports staking rewards and EtherFiAdmin applies them. Hard caps bound every report: at most 0.25% up per report and 5% implied APR, with negative moves capped tighter. Each report executes only after a delay of 10 minutes past consensus, in which the operating multisig can cancel it.\n\n### Custody and exit\n\neETH is a staking aggregator rather than a single validator set. ETH deposits fund new compounding validators of 1901 ETH each, run by ether.fi's permissioned operators. Their withdrawal credentials are fixed in code to a protocol-controlled address, the EigenLayer pod of the ether.fi node they belong to or, for a node created without a pod, the node contract itself, so operators run the keys but cannot redirect the stake. The Liquifier accepts already-staked liquid staking tokens from other providers against a governance-set whitelist and mints eETH for them, and EtherFiRestaker holds them and can unwind them to ETH through the provider's own exit. To exit, burn eETH for a withdrawal NFT that the oracle must finalize before the pool pays, or swap instantly through a buffer for a fee up to 5%. On-chain finalization depends on the 3-of-3 committee, and the permissionless stale-oracle backstop only opens if the committee stops reporting entirely. Only a small buffer is instantly liquid, so large exits wait for validators to unwind.\n\n\n\n### Who holds the keys\n\nUpgrades and every role grant sit behind a 10 days timelock. A shorter 2 days timelock tunes parameters within fixed ceilings and registers validator spawners, the accounts that register validator keys, so a newly whitelisted operator can only run validators after that delay. Multisigs handle the rest without delay: whitelisting and removing operators, pausing and blacklisting.",
"links": {
"websites": [
"https://ether.fi/"
],
"documentation": [
"https://etherfi.gitbook.io/etherfi"
],
"repositories": [
"https://github.com/etherfi-protocol/smart-contracts"
],
"socialMedia": [
"https://x.com/ether_fi"
]
},
"references": [
{
"title": "Deployed Contracts — ether.fi docs",
"url": "https://etherfi.gitbook.io/etherfi/developers/contracts-and-integrations/deployed-contracts"
}
]
}
externalDependencies+2-2
[
{
"type": "not-tracked",
"name": "EigenLayer",
"icon": "eigenlayer",
"description": "Holds the native stake of EigenPod-backed nodes: their validators' withdrawal credentials point at an EigenLayer EigenPod, so that ETH sits inside EigenLayer contracts. Its DelegationManager, EigenPodManager and StrategyManager are upgradeable by EigenLayer governance, and since the slashing release an AVS can slash delegated stake. Exits from these pods also wait out EigenLayer's roughly 14-day withdrawal delay. A node created without a pod is itself its validators' withdrawal address and requests exits directly through the EIP-7002 system contract, outside EigenLayer."
"description": "Holds the native stake of EigenPod-backed nodes: their validators' withdrawal credentials point at an EigenLayer EigenPod, so that ETH sits inside EigenLayer contracts. The pods and EigenLayer's DelegationManager, EigenPodManager and StrategyManager are upgradeable by EigenLayer governance, through its timelock or at once by its community multisig, and since the slashing release an AVS can slash delegated stake, but only stake an operator has allocated to it; the pods are delegated to operators ether.fi runs itself. Exits from these pods also wait out EigenLayer's roughly 14-day withdrawal delay. A node created without a pod is itself its validators' withdrawal address and requests exits directly through the EIP-7002 system contract, outside EigenLayer."
},
{
"type": "tracked",
"projectId": "lido",
"description": "About a quarter of the backing is stETH taken through the Liquifier and held by EtherFiRestaker rather than native ETH. A stETH depeg or a Lido failure directly impairs that share of eETH."
"description": "About a fifth of the backing is stETH taken through the Liquifier and held by EtherFiRestaker rather than native ETH. A stETH depeg or a Lido failure directly impairs that share of eETH."
},
{
"type": "not-tracked",
"name": "LayerZero",
"icon": "layerzero",
"description": "weETH crosses chains as a LayerZero OFT. The mainnet lock-box holds ~110k weETH, and an L1 sync pool anticipatorily mints weETH against a dummy placeholder when a LayerZero message reports an L2 deposit, before the bridged ETH arrives (live unbacked ~45 weETH). A compromise of the LayerZero endpoint or its verifiers could forge inbound messages to unlock real weETH from the lock-box or mint against shared backing, and a messaging halt would strand cross-chain holders. Cross-chain integrity depends on LayerZero, bounded by the lock-box balance and the dummy token's Liquifier cap."
}
]