Quick Answer
Restaking introduces a new risk category to Ethereum's security model: systemic slashing risk. A single large slashing event can propagate from an AVS → operator → LRT token price → lending market liquidations, affecting protocols and users far removed from the original slash. Auditing the on-chain logic that governs this cascade is the core challenge of restaking security.
Each AVS defines its own slashing conditions. These contracts must be deterministic, verifiable on-chain, and impossible to trigger via malicious input from the AVS operator. They are the highest-value audit target in the restaking stack.
Operators sign AVS attestations with ECDSA keys. Hot signing keys for frequent attestation must be isolated from admin and withdrawal keys — a single compromised key should not expose all operator stake.
Liquid restaking tokens represent delegated + restaked ETH. Minting/redemption logic, oracle price feeds to lending markets, and withdrawal queue handling all introduce failure modes that can depeg LRTs during market stress.
EigenLayer's withdrawal queue creates a timing gap between initiating and completing unstaking. Slashing that occurs during this window can reduce the withdrawal amount — restakers need to understand this asymmetric risk before delegating.
| Vulnerability | Severity | Description | Example |
|---|---|---|---|
| Slashing Condition Manipulation | Critical | EigenLayer AVSs define their own slashing conditions — the on-chain logic that determines when operator stake is penalized. Maliciously designed or buggy slashing conditions can create scenarios where honest operators are slashed (losing restaker capital) or dishonest operators are never slashed (removing the security guarantee). The slashing contract is the most critical security boundary in a restaking protocol — its conditions must be verifiable, deterministic, and resistant to griefing attacks by the AVS itself. | An AVS slashing contract that evaluates slashing based on off-chain signature data submitted by the AVS operator — the AVS can forge or selectively submit data to slash operators it wants to penalize while protecting its own stake. |
| Operator Key Compromise | Critical | Restaking operators sign attestations and participate in AVS consensus using ECDSA keys. If an operator's signing key is compromised, the attacker can: (1) sign fraudulent AVS attestations, triggering valid slashing of the operator's restaked capital, (2) perform double-signing or other slashable offenses to drain delegated stake, or (3) participate in coordinated attacks on the AVS's security guarantee itself. Key compromise is the highest-probability path to operator capital loss in the current restaking ecosystem. | An EigenLayer operator using a single hot signing key for all AVS attestations — one server compromise means the attacker can double-sign on any AVS the operator validates, triggering slashing for every delegator who chose that operator. |
| LRT (Liquid Restaking Token) Depegging | High | Liquid restaking tokens like eETH (ether.fi), rsETH (Kelp), and ezETH (Renzo) represent staked + restaked ETH positions as tradeable tokens. These tokens rely on the underlying ETH being redeemable at approximately 1:1 with the represented value. If a large slashing event reduces the underlying ETH value faster than the LRT price adjusts, or if withdrawal queues prevent timely redemption during market stress, LRT holders can be left holding tokens worth significantly less than par value. | A 5% slashing event across a large operator set reduces the ETH backing ratio of an LRT from 1:1 to 0.95:1. If the LRT is used as collateral in lending protocols (Aave, Compound), positions that were at 80% LTV are suddenly liquidatable — a cascading liquidation event across all lending markets that accepted the LRT. |
| Withdrawal Queue Timing Attack | High | EigenLayer imposes withdrawal queuing periods that delay when operators can withdraw staked ETH. These delays create a timing asymmetry: if an operator discovers a slashable condition before the slashing is enforced, they can initiate withdrawal to move capital out of the slashable queue before the slash is applied. Conversely, a sudden slashing event during the withdrawal queue period can reduce a restaker's capital mid-withdrawal — the final withdrawal amount is less than the amount queued. | An operator detects that a bug in an AVS slashing contract will cause spurious slashing. The operator initiates withdrawal before the slashing is applied, but the withdrawal queue is 7 days. If EigenLayer processes the slash before the 7-day withdrawal completes, the operator loses stake they thought they'd already moved to safety. |
| AVS Collusion for Invalid Slashing | High | EigenLayer's security model assumes AVSs act honestly and only slash provably misbehaving operators. An AVS controlled by a malicious actor could design slashing conditions that allow it to slash honest operators under contrived pretenses — effectively using the AVS framework to steal delegator capital without a real security violation. Restakers who choose operators registered with a malicious AVS are exposed to this attack. | An AVS whose slashing contract allows the AVS admin to submit any 'violation proof' signed by the AVS's own key, with no on-chain verification that the proof represents actual operator misbehavior — the AVS admin slashes all operators, stealing delegator stake. |