eigenlayer.xyz
Summary
EigenLayer is the dominant Ethereum restaking protocol with roughly $4.7B in TVL across Ethereum and Base, securing staked ETH and liquid staking tokens for Autonomous Verifiable Services. Smart contract security is unusually strong—19 disclosed audits, a $2M Immunefi bounty, and zero on-chain exploits over three years of production—but governance is more centralized than marketing suggests, with multiple upgrade paths bypassing the documented 10-day timelock. EIGEN tokenomics add material sell pressure via 8% annual inflation, ~37M monthly insider unlocks through September 2027, and emission-subsidized rewards rather than fee revenue. Overall risk is moderate-to-elevated at 5.7/10.
Trust Assumptions
Restakers must trust that the 3-of-5 Protocol Council and 3-of-6 Operations multisigs (Eigen Labs–affiliated) will not abuse upgrade authority over $4.7B in upgradeable proxy contracts, that the 9-of-13 Community multisig will not exploit its ability to upgrade core contracts immediately via a 1-of-2 ProxyAdmin Safe, and that the 1-of-7 Pauser multisig will not halt deposits or withdrawals without genuine cause. Users also depend on Ethereum beacon-chain proofs via EIP-4788 with no fallback, on LST issuers (Lido, Rocket Pool, Coinbase) not depegging or pausing, on individual AVS slashing logic not cascading across shared operator stake, and on the unverified EmissionsController correctly minting the ~146M EIGEN issued annually.
What Could Go Wrong
A compromised Community multisig quorum (9 of 13 signers) or Operations multisig quorum (3 of 6 signers) could upgrade DelegationManager, StrategyManager, bridge contracts, or the EmissionsController without the advertised 10-day timelock, potentially altering slashing, withdrawal, or minting logic affecting billions in restaked collateral. An AVS slashing event or LST depeg could cascade through StrategyManager to reduce slashable stake across multiple services simultaneously, while persistent 8% EIGEN inflation and ~37M monthly insider unlocks could compress token value independent of protocol health. October 2024 demonstrated operational fragility: a $5.7M email-phishing theft of investor tokens and an X account hack costing users an estimated $800K–$1M—neither was a contract exploit, but both show social-engineering and custody risks around a team-controlled, non–token-voted governance structure.
Recommendation
EigenLayer is reasonable for experienced restakers who understand slashing exposure and accept multisig-led governance, but capital allocators should size positions assuming upgrade authority is more concentrated than public documentation implies. Monitor on-chain pause state (RewardsCoordinator is partially paused), monthly EIGEN unlock events, Operations multisig activity on bridge whitelist changes, and any proxy upgrades initiated outside the 10-day timelock path. EIGEN holders and yield farmers should be especially cautious given uncapped inflation and insider vesting; reduce exposure if unverified contracts (EmissionsController, KeyRegistrar) remain unverified, if Base bridge governance is not brought to mainnet parity, or if new AVS slashing parameters are deployed without post-upgrade audit coverage.
Key Findings (30)
Analysis Sections
EigenLayer mainnet uses verified Gnosis Safe multisigs (Protocol Council 3/5, Operations 3/6, Community 9/13, Pauser 1/7) with a 10-day OpenZeppelin TimelockController for core upgrades. Operations can propose and cancel timelock transactions; Protocol Council executes. However, several upgrade paths bypass the timelock (Community via 1-of-2 ProxyAdmin safe; Operations directly owns bridge/rewards contracts), pausing requires only 1-of-7 signatures, and Base chain governance is materially weaker (1-day timelock, identical 3/6 PC/Ops signer sets, bridge proxies owned by Operations without timelock). No on-chain token voting exists.
Findings (7)
On-chain verification shows Base uses a 1-day timelock (86400s) vs 10 days on Ethereum (864000s). Base Protocol Council and Operations multisigs share identical 3-of-6 signer sets (0x841b... and 0x8ed5...), unlike mainnet's distinct 3/5 and 3/6 councils. Base Community multisig is only 3-of-6 with 50% signer overlap with PC/Ops. Bridge contracts OperatorTableUpdater and TaskMailbox on Base are UUPS proxies owned directly by Base Operations multisig with no timelock intermediary.
StrategyManager, EigenPodManager, EIGEN, and bEIGEN are owned by a 1-of-2 Gnosis Safe (0x369e6F597e22EaB55fFb173C6d9cD234BD699111) whose owners are the main timelock and the Community multisig. With threshold 1, the 9-of-13 Community multisig can execute upgrades or token admin actions immediately without waiting for the 10-day timelock delay.
CrossChainRegistry (0x9376a586...) and RewardsCoordinator (0x7750d328...) on Ethereum are UUPS proxies with owner set directly to the Operations multisig (0xBE1685C81aA44FF9FB319dD389addd9374383e90). A 3-of-6 Eigen Labs-controlled multisig can upgrade these contracts immediately, bypassing the 10-day timelock that protects other core contracts.
The Pauser multisig (0x5050389572f2d220ad927ccbea0d406831012390) requires only 1-of-7 signatures to act. Documentation claims 1-of-8 but on-chain verification shows 7 owners. Any single pauser key compromise enables immediate protocol-wide pause of deposits and critical functions.
EigenLayer governance operates through appointed multisigs and an off-chain ELIP process, not on-chain EIGEN token voting. Protocol Council (including 2 Eigen Foundation members per charter) holds sole execution authority for core upgrades. Operations multisig holds timelock CANCELLER_ROLE, enabling veto of queued proposals.
Official documentation lists Pauser as 1-of-8, but on-chain getOwners() returns 7 addresses on Ethereum mainnet and 6 on Base. Threshold of 1 is confirmed on both chains.
Primary timelock enforces 10-day delay (864000 seconds). bEIGEN-dedicated timelock enforces 24-day delay (2073600 seconds). Protocol Council and Operations are confirmed proposers; Operations is the sole canceller; Protocol Council is executor.
Governance Checklist
Multisig Configuration (On-Chain Verified)
| Chain | Multisig | Address | Threshold | Owners |
|---|---|---|---|---|
| Ethereum | Protocol Council | 0x461854d84ee845f905e0ecf6c288ddeeb4a9533f | 3/5 | 5 |
| Ethereum | Operations | 0xbe1685c81aa44ff9fb319dd389addd9374383e90 | 3/6 | 6 |
| Ethereum | Community | 0xfea47018d632a77ba579846c840d5706705dc598 | 9/13 | 13 |
| Ethereum | Pauser | 0x5050389572f2d220ad927ccbea0d406831012390 | 1/7 | 7 |
| Ethereum | Multichain Deployer | 0xa3053ef25f1f7d9d55a7655372b8a31d0f40eca9 | 3/7 | 7 |
| Base | Protocol Council | 0x841b988aaeafce13b6456ff34015fbc42aedb7e6 | 3/6 | 6 |
| Base | Operations | 0x8ed55c7640497db15ac32c698c1a06e2e604d865 | 3/6 | 6 |
| Base | Community | 0xc107547924c7d1d3e2d10ea8df534bbfc5f373e6 | 3/6 | 6 |
| Base | Pauser | 0x1a051ef1524cbaea57ca04319ef93fe78903d5e6 | 1/6 | 6 |