{"license":"CC-BY-4.0","licenseUrl":"https://creativecommons.org/licenses/by/4.0/","attribution":"ChainChoice (https://chainchoice.io)","category":"restaking","evidenceReadAt":"2026-09-28","generatedAt":"2026-11-12","criteria":[{"id":"slashingSurface","label":"What exactly can be taken from me, and who gets to decide?","weight":34},{"id":"worstCaseExit","label":"How long until I actually have my ETH back on the worst day, not the good one?","weight":26},{"id":"incidentRecord","label":"What has actually gone wrong here, what did it cost, and did the vendor own it?","weight":26},{"id":"dependencyCurrency","label":"Does the wrapper tell me what it runs on, and is what it tells me still true today?","weight":14}],"providers":{"eigenlayer":{"slashingSurface":{"s":8,"q":"`wadsToSlash` MUST be within the bounds `(0, 1e18]` | Once triggered in the `AllocationManager`, slashing is instant and irreversible. | The `avs` also specifies a `slasher`, an address that can slash the operatorSet. | Only 1 address can slash an operatorSet.","u":"https://raw.githubusercontent.com/Layr-Labs/eigenlayer-contracts/main/docs/core/AllocationManager.md","d":"2026-09-28"},"worstCaseExit":{"s":7,"q":"The exit queue has never exceeded 7 days. | Fixed at 256 epochs (~27 hours). | Currently 0-9.1 days (randomized based on validator index in the sweep order). | 7-day* mandatory waiting period before final withdrawal can be executed.","u":"https://raw.githubusercontent.com/Layr-Labs/eigencloud-docs/main/docs/eigenlayer/restakers/concepts/native-restaking-withdrawal-delays.md","d":"2026-09-28"},"incidentRecord":{"s":7,"q":"As a key component of our development process, please see the most recent audits that help assess the robustness and reliability of our systems:","u":"https://raw.githubusercontent.com/Layr-Labs/eigencloud-docs/main/docs/eigenlayer/security/audits.md","d":"2026-09-28"},"dependencyCurrency":{"s":5,"q":"Access $10B+ in staked ETH and 350+ operators from day one. | $10 billion+ | ETH Staked | 39,000+ | Active stakers","u":"https://www.eigencloud.xyz/eigenlayer","d":"2026-09-28"}},"symbiotic":{"slashingSurface":{"s":7,"q":"If the vault uses VetoSlasher, the request enters a veto period. For vetoDuration seconds after creation, any configured resolver can veto the request. | Once chosen at deployment, the slashing model for a vault is fixed.","u":"https://docs.symbiotic.fi/learn/core-concepts/slashing","d":"2026-09-28"},"worstCaseExit":{"s":7,"q":"the effective delay from request to claim is in [E, 2E) depending on when in the epoch the user requested | the requested funds remain slashable After that boundary, the withdrawal can be claimed and is no longer subject to new slashes. | use the same duration unless the curator later increases it","u":"https://docs.symbiotic.fi/learn/mechanics/epochs-and-delays","d":"2026-09-28"},"incidentRecord":{"s":9,"q":"failure to satisfy an application's requirements may result in slashing","u":"https://docs.symbiotic.fi/get-started/resources/risks","d":"2026-09-28"},"dependencyCurrency":{"s":5,"q":"Epochs are consecutive and all have the same length. The epoch length is set at vault deployment.","u":"https://docs.symbiotic.fi/learn/core-concepts/vault","d":"2026-09-28"}},"renzo":{"slashingSurface":{"s":5,"q":"Several protocols have already expressed interest in joining the Eigenlayer AVS ecosystem. Let's take a closer look at some of the prominent AVSs.","u":"https://docs.renzoprotocol.com/docs/restaking-ecosystems/understanding-eigenlayer/autonomous-verifiable-services.md","d":"2026-09-28"},"worstCaseExit":{"s":7,"q":"Beacon chain exit time is between 9-10 days | EigenLayer’s minimum withdrawal delay is set to 14 days | Renzo’s WithdrawQueue buffer delay is set to 3 days | If the WithdrawalQueue buffer has assets, the expected wait time is **7 days** and if empty, the expected wait time is between **10-15 days**","u":"https://docs.renzoprotocol.com/docs/services/withdrawals.md","d":"2026-09-28"},"incidentRecord":{"s":6,"q":"On November 3, 2025, the V2 Protocol experienced a critical security breach affecting the V2 StableSwap contracts. The exploit led to unauthorized withdrawals amounting to roughly $128 million.","u":"https://gov.renzoprotocol.com/raw/268","d":"2026-09-28"},"dependencyCurrency":{"s":5,"q":"New name. Bigger vision. Renzo Finance is live at RenzoFinance.com","u":"https://www.renzoprotocol.com/","d":"2026-09-28"}},"swell-restaking":{"slashingSurface":{"s":5,"q":"The AVS Selection Framework is currently under construction. It will include active measures to minimize risks for restakers | More soon.","u":"https://docs.swellnetwork.io/swell-staking/rsweth-liquid-restaking/avs-selection","d":"2026-09-28"},"worstCaseExit":{"s":7,"q":"Withdrawals are subject to waiting times of up to 28 days, with very occasional delays beyond this | Native restaking on EigenLayer is subject to withdrawal times of 14 days | This was increased from 7 days with the launch of slashing, to allow for AVSs to properly account for and slash, if…","u":"https://docs.swellnetwork.io/swell-staking/rsweth-liquid-restaking/rsweth-v1.0-system-design/withdrawals","d":"2026-09-28"},"incidentRecord":{"s":7,"q":"Swell is offering rewards of up to $250,000 USD for reporting of low to critical vulnerabilities on all levels of our technology stack","u":"https://docs.swellnetwork.io/swell-staking/risks/bug-bounty","d":"2026-09-28"},"dependencyCurrency":{"s":2,"q":"Restake ETH on eigenlayer and secure Swell L2 | RSWETH TVL $292,353,232 | swETH TVL $200,000,000 | total tvl $1,803,203,203","u":"https://www.swellnetwork.io/","d":"2026-09-28"}},"ether-fi":{"slashingSurface":{"s":5,"q":"Symbiotic → Cap Protocol → M11 Credit (borrower) → Pareto Vault → FalconX | **Slashing Risk:** If the loan collateral reaches an excessively high loan-to-value (LTV) ratio, delegated funds may be partially or fully slashed. This would result in a loss of principal for weETHs holders.","u":"https://etherfi.gitbook.io/etherfi/products/staking/weeths-super-symbiotic.md","d":"2026-09-28"},"worstCaseExit":{"s":5,"q":"No, it is a 7-day withdrawal period. While most withdrawals will complete well before this maximum window, this is an additional safety mechanism added by Veda. | **Liquidity Risk:** Delegated capital may not be immediately available for withdrawal.","u":"https://etherfi.gitbook.io/etherfi/products/staking/weeths-super-symbiotic.md","d":"2026-09-28"},"incidentRecord":{"s":8,"q":"On September 11, 2026, an attacker exploited a missing authorization check in the legacy Veda AtomicQueue contract | Realized user loss was approximately $40K on Ethereum across a small number of wallets, plus approximately 2,257 sETHFI on Arbitrum. All affected users are being reimbursed in full.","u":"https://etherfi.gitbook.io/etherfi/security/security-and-risks/incident-management/sep-11-incident-legacy-atomicqueue-exploit.md","d":"2026-09-28"},"dependencyCurrency":{"s":5,"q":"eETH and weETH do **not** bundle additional restaking rewards or EigenLayer AVS slashing exposure.","u":"https://etherfi.gitbook.io/etherfi/products/staking/eeth.md","d":"2026-09-28"}},"puffer":{"slashingSurface":{"s":4,"q":"Penalties can also accrue if the restaking operator is slashed running AVSs, which is why Puffer is restricting restaking operator participation during its nascent stages","u":"https://docs.puffer.fi/yield/protocol/nlrt","d":"2026-09-28"},"worstCaseExit":{"s":7,"q":"include a 1% fee on the withdrawn amount | although it might take around 14 days to complete | This is a multi step process that includes sending a voluntary exit message to the Beacon Chain and queueing a withdrawal request to the Eigenlayer protocol.","u":"https://docs.puffer.fi/yield/stakers/withdraw","d":"2026-09-28"},"incidentRecord":{"s":6,"q":"Since launching in 2024, Puffer has grown to more than $1 billion in peak TVL and processed over $1 billion in ETH redemptions, without pauses, withdrawal gates, or depegging.","u":"https://blog.puffer.fi/posts/puffer-sets-a-higher-standard-of-security-for-every-eth-staked","d":"2026-09-28"},"dependencyCurrency":{"s":5,"q":"The community multisig can bypass the timelock delay and has veto rights over actions initiated by the operations multisig.","u":"https://docs.puffer.fi/yield/deployments/multisig","d":"2026-09-28"}},"kelp-dao":{"slashingSurface":{"s":5,"q":"Kelp has partnered with reputed Node Operators to run validators on the beacon chain and Eigenlayer. The following validator partners support Kelp both with operating beacon chain nodes and restaking to AVSs on EigenLayer.","u":"https://kerneldao.gitbook.io/kernel/getting-started/kelp/node-operator-partners.md","d":"2026-09-28"},"worstCaseExit":{"s":3,"q":"Standard withdrawal is free, but you will have to wait for 15-21 days to get your stake back | You can only withdraw your rsETH as ETH, ETHx, or stETH on the Ethereum chain.","u":"https://kerneldao.gitbook.io/kernel/getting-started/kelp/restaking-guide","d":"2026-09-28"},"incidentRecord":{"s":5,"q":"On April 18, 2026, the bridge verification infrastructure that processes cross-chain rsETH messages was compromised outside of Kelp's operational domain. | We have requested a full root-cause analysis from the infrastructure provider and will share details as soon as we have it.","u":"https://blogs.kerneldao.com/blog/kelp-dao-%C2%B7-incident-response-%C2%B7-april-19-2026","d":"2026-09-28"},"dependencyCurrency":{"s":4,"q":"Every rsETH LayerZero route enforces 4-of-4 independent DVNs (Canary, Horizen, LayerZero Labs, Nethermind), with 64 confirmations, in a hub-and-spoke topology | On-chain daily mint caps: | dailyMintLimit() | 500 rsETH/day","u":"https://kerneldao.gitbook.io/kernel/getting-started/kelp/security/cross-chain-architecture.md","d":"2026-09-28"}}}}