The restaking provided by EigenLayer enables the Actively Validated Services (AVSs) to reuse the trust of the Ethereum staking pool and enhance the global trust model. However, it also introduces three potential security risks in the whole ecosystem, including:
- Malicious Operators
- Malicious AVS
- Security of the EigenLayer Itself
We advocate for implementing specific security services and products to fortify the ecosystem, such as auditing EigenLayer and AVS. Additionally, a robust continuous security monitoring and attack-blocking platform is crucial, capable of executing automatic actions upon detecting attacks.
In the following, we will present EigenLayer's basic idea and illustrate the new security threats in the restaking ecosystem.
Introduction
EigenLayer, a protocol built on Ethereum, introduces the concept of Restaking. It allows participants to utilize staked ETH further to support other distributed protocols while maintaining their original stake and rewards, maximizing the potential value of capital.
The exponential growth of EigenLayer's Total Value Locked (TVL), from $1 billion at the beginning of 2024 to the current $15.3 billion, is a testament to its potential. It now stands as the second-largest protocol in the DeFi ecosystem, just behind Lido. This rapid expansion reflects strong market interest and validates the practicality and impact of EigenLayer's technology. Consequently, projects built on the EigenLayer ecosystem, such as Puffer Finance and Renzo, have also quickly gained capital and user attention, further solidifying EigenLayer's position in the market.
What's Restaking
Restaking is a mechanism that leverages the trust provided by the Ethereum Proof of Stake (PoS) staking pool to further solve specific problems. It introduces a new market - a "free-market governance of Consensus" - that enables the bidirectional trading of trust based on the Ethereum's pooled security.
EigenLayer claims that the current Ethereum ecosystem is facing a macro-level security issue of "Fractured Trust" and that EigenLayer can effectively mitigate or even address this problem. In the following discussion, we will explore the concept of Fractured Trust and examine how EigenLayer aims to resolve this challenge based on the design and motivations behind the EigenLayer.
Who are the service objects in the free market?
EigenLayer is market for selling the trust provided by the Ethereum staking pool, so the sellers of PoS trust are naturally the Ethereum validators, or stakers. On the other hand, the buyers are the Actively Validated Services (AVSs) - the entities that actively require a distributed trust network. In such scenario, the AVSs, as the buyers, have a desire to purchase this distributed trust.
What problem does this market want to address?
EigenLayer wants to address two issues: the unsatisfied invocation needs and Fractured Trust in the Ethereum ecosystem.
Unsatisfied innovation needs
Ethereum primarily and only offers innovations at the contract layer. Developers can leverage smart contracts to implement different innovative products, e.g., DeFi protocols. However, developers want more "fundamental" innovations, such as attempts to modify the runtime environment (the Ethereum Virtual Machine, or EVM, in the case of Ethereum), or even more ambitious aspirations to alter the consensus protocol itself.
The founders of EigenLayer have recognized the developers' desire for fundamental, low-level innovations as an unsatisfied market need. They address it by providing a free-market for reusing Ethereum's trust.
Fractured Trust in the Ethereum ecosystem
The EigenLayer has also tried to address the "Fractured Trust" issue that arises from the innovation constraints within the Ethereum ecosystem. In Ethereum's Proof-of-Stake (PoS) mechanism, security relies on the availability of sufficient staked capital and the number of validator nodes. When new projects attempt to establish their own trust networks, they often require staking of their own tokens, leading to the leakage of staked funds from the Ethereum mainnet, thereby impacting its overall security.
For instance, if the Ethereum mainnet has 10B in staked capital, and the total staked across three separate sub-services is 3B. These 3B's capital in staked funds does not directly strengthen the security of the mainnet, while it does serve the Ethereum mainnet. Additionally, Fractured Trust can also heighten the security risks for decentralized applications (dApps), as attackers may target the less-staked AVSs, exploiting their weaker PoS within the system to cause more widespread security issues.
In summary, the current Ethereum ecosystem is facing two interrelated challenges: the problem of constrained innovation, as well as the issue of "Fractured Trust" that arises from this limitation on innovation. And EigenLayer wants to address these issues.
How does EigenLayer address these issues?
The existing AVS can not reuse the trust of Ethereum since they lacks access to Ethereum staking pools and cannot perform Slashing. The Restaking method is an interface enabling AVS to access Ethereum staking pools, with EigenLayer serving as the middleware. Within the EigenLayer, services are implemented as smart contracts, while Ethereum's underlying infrastructure ensures this platform's reliability. Through this platform, AVS can define its validation requirements and incentive mechanisms, attracting ETH validators to participate at lower costs, thereby enhancing the security and efficiency of the entire network. These AVSs must deploy dedicated Slashing and Payment Contracts, allowing validators to choose participation according to their profitability needs.
Does EigenLayer effectively address them? What is the cost?
Firstly, for the issue of constrained innovation, by leveraging the trust provided by Ethereum staking pools, AVSs can indirectly absorb Ethereum's trust, effectively reducing the bootstrapping costs of such services and providing prerequisites for the flourishing of the blockchain ecosystem.
Secondly, the problem of Ethereum's Fractured Trust is mitigated. On the one hand, ETH stakers can opt-in restaking to support chosen AVSs through EigenLayer, significantly facilitating the return flow of staked funds diverted to decentralized AVSs back to Ethereum's staking pools. On the other hand, the cost for validators to engage in validation is reduced. For AVSs themselves, this allows for attracting more re-staked assets at a lower cost, thereby reinforcing the weakest link in the chain of attack scenarios mentioned earlier and enhancing overall security.
From a design perspective, many projects, such as Cosmos IBC and OP Stack, enable emerging projects to launch a new blockchain at a relatively lower cost. However, they fail to address the Fractured Trust issue. EigenLayer mitigates the Fractured Trust issue, reduces the barriers for AVSs, and provides higher returns for ETH Validators (accompanied by risks).
New Security Concerns of EigenLayer Ecosystem
The EigenLayer, a free-market governance of consensus, can be divided into three main entities:
- Operators, commonly perceived as ETH Validators, or stakers, act as trust sellers.
- AVSs, representing services requiring decentralized PoS trust, serve as buyers.
- The EigenLayer platform, supporting Operators and AVSs, functions as the marketplace.
These three entities constitute the ecosystem of EigenLayer, with each part susceptible to security threats that could affect the stability of the entire ecosystem.
The Reduced Cost of Malicious Operators
Within the EigenLayer ecosystem, ETH Validators only need to commit a single capital stake to receive multiple returns potentially. This significantly enhances the utilization of staked funds, lowering the barrier for Operators to enter AVSs' service trust networks. Correspondingly, Operators are required to undertake validation tasks specified by the selected AVSs, thereby assuming additional risks. The increased fund utilization rate also substantially reduces the cost of misconduct for malicious Operators.
The whitepaper of EigenLayer has proposed a potential solution: the establishment of an publicly accessible Dashboard. This Dashboard allows AVSs to verify whether the Operator providing Restaking collateral has engaged in multiple staking instances, among other relevant information. The whitepaper emphasizes that this is a bidirectional free market, and what if an AVS chooses to disregard malicious func utilization and allow multiple restaking? Such an approach can evidently attract more restaking collateral. It's contingent upon the AVSs' own considerations and trade-offs.
Malicious AVSs
AVS primarily offers reward and punishment mechanisms for Restaking collateral in the EigenLayer market. These mechanisms, determined by AVS itself, correspond to contracts deployed on the Ethereum mainnet. For sure, Operators and EigenLayer can request AVS project parties to open source such contracts, but we can still not guarantee that every Operator has the necessary capacity and resources to verify the reliability of the AVS services they intend to purchase. The may lead to malicious AVS entities attracting Operators through false or exaggerated information, leading to unintended slashing from exploitation of contract vulnerabilities or potential backdoor. Markets always tend to pursue profit, and malicious AVS may attract relatively blind Operators, ultimately subjecting them to malicious slashing and causing irreparable losses.
To prevent such incidents, security audits can be conducted to ensure the basic security and reliability of AVS's reward and punishment mechanisms. The EigenLayer whitepaper wishes that all relevant contracts related to reward and punishment should undergo reasonable auditing and security evaluation. Additionally, the whitepaper suggests the establishment of a committee to regulate the slashing reward and punishment mechanism, helping emerging AVS entities take the right path.
Security of the EigenLayer Itself
Finally, it's the security of EigenLayer itself, that is, the security of the market platform. If EigenLayer platform itself experiences security vulnerabilities, it can pose significant harm to the entire ecosystem and even directly threaten the security of Ethereum's PoS consensus. Considering that EigenLayer aims to provide a bi-directional free trade market for Operators and AVSs, it needs to offer more customized interfaces for both parties to support diverse requirements. These increased sophisticated demands can also make the EigenLayer more complex, which in turn leads to additional potential security threats.
Since EigenLayer itself is implemented through Ethereum smart contracts, its basic reliability can also be ensured through code audits and post-deployment security monitoring.
Solutions
EigenLayer innovatively introduces the Restaking mechanism, which not only optimizes capital utilization but also mitigates the Fractured Trust issue while improving network scalability. However, alongside its numerous innovative advantages, it also introduces new security challenges and potential risks, such as the reduction in malicious cost due to increased capital utilization. Therefore, it is crucial for blockchain developers, investors, and security experts to focus on these associated issues and seek solutions.
BlockSec provides security services and products in both pre- and post-launch stages. Our security auditing services can perform the security review of the AVS to ensure its security and openless. Our Phalcon product provides continuous security monitoring and attack detection capabilities. This can help the users, AVS and liquality providers to monitor the AVS, EigenLayer and perform automatic actions when security risks are detected.
Related Reading
- How L2 Blockchains Can Do Better to Protect Their Users
- Top 10 "Awesome" Security Incidents in 2023
- Conceptual Full Analysis A Rise Of Bitcoin With Inscription
About BlockSec
BlockSec is a full-stack Web3 security service provider. The company is committed to enhancing security and usability for the emerging Web3 world in order to facilitate its mass adoption. To this end, BlockSec provides smart contract and EVM chain security auditing services, the Phalcon platform for security development and blocking threats proactively, the MetaSleuth platform for fund tracking and investigation, and MetaSuites extension for web3 builders surfing efficiently in the crypto world.
To date, the company has served over 300 clients such as Uniswap Foundation, Compound, Forta, and PancakeSwap, and received tens of millions of US dollars in two rounds of financing from preeminent investors, including Matrix Partners, Vitalbridge Capital, and Fenbushi Capital.
-
Website: https://blocksec.com/
-
Email: contact@blocksec.com
-
Twitter：https://twitter.com/BlockSecTeam
-
MetaSleuth: https://metasleuth.io/
-
MetaSuites: https://blocksec.com/metasuites
