TLDR
LRTs have become the new preferred collateral for taking sizable amounts of leverage, primarily via looping, onchain. The debt that weETH —the largest LRT — collateralizes on Aave is striking in size. In this post, we simulate how slashing events can lead to amplified TVL drawdowns in EigenLayer due to potential liquidations on Aave — the deepest onchain lending market. Assuming positions are not repaying debt or supplying more collateral, we find that a slash^ of ~2% on weETH could lead to a TVL decay of ~$1B on EigenLayer. This suggests that slashing events at the current market collateralization levels may have reverberating effects throughout other LRTs and across DeFi. We then propose potential mechanism modifications that can mitigate some of these risks.
^ We assume slashing is an immediate loss in underlying funds for the LRT at the current stage.
Liquid Restaking Tokens (LRTs) make up a majority of TVL currently deposited in EigenLayer (EL) and, over the past year, have become integrated into the broader DeFi ecosystem. As a result, their scale, size, and distribution throughout DeFi can present risk to both EL and the broader ecosystem. This can manifest when realized, unexpected slashing events have second-order effects beyond immediate loss of stake. These effects range from destabilizing position health on lending protocols, causing the liquidation of LRT collateralized positions with the highest LTV (loan-to-value), to negatively influencing future stake inflow.
- This may reduce how effectively an LRT can service an AVS that relies on that stake or limit the role an LRT can play in a growing AVS landscape.
These market dynamics <> slashing dynamics ultimately impact one another, forming a spectrum of potential stress events to the restaking landscape. We examine what scenarios can exaggerate these slash events and how these events can impact exogenous DeFi systems.
We index on the DeFi lending markets, their exposure to LRT collateralized debt, and the events that might create risk in restaking. In particular, given its status as the largest LRT by market cap, we focus on ether.fi (weETH), its presence on Aave, and the liquidation risks it may bring. We find that weETH supports significantly more debt than Lido wstETH, perhaps indicating that:
- the markets are potentially mispricing the future slashing risk
- LRT-driven lending behavior has honed in on maximizing restaking airdrop and point potential
The debt that weETH collateralizes is striking in size. We simulate the effects of slashing on potential liquidations on the lending protocol. Assuming positions are not repaying debt or supplying more collateral, a slash of ~2% on weETH could lead to a TVL decay of ~$1B from EL, amplifying the amount of TVL decay from the slash itself by almost 7x.
Below, we first give brief context on the lending market structure and our simulation mechanisms, design, and assumptions. We’ll then explore some of the findings that suggest slashing events may be quite expensive to the restaking space, and finally conclude with potential mechanism improvements that can mitigate some of these risks.
Impacts on the DeFi ecosystem
There are a couple of ways in which an LRT’s market price can suffer a drawdown. Dislocations represent deltas in the LRT market price with respect to its net asset value (NAV) — the composition of the underlying ETH-denominated assets that back the LRT. These dislocations propagate throughout DeFi through immediate impacts on the market and are often functions of both magnitude and time duration of the dislocation. Smaller market dislocations within create/redeem and other associated fees of the LRT are quite common and expected due to lack of arbitrage within the create/redeem bounds. However, from a behavioral perspective, an LRT that consistently trades at an excessive discount may see onchain liquidity and market cap decay or changes in its whale concentration over time
On the other hand, the slash reduces the magnitude of the underlying itself and is a fundamental change to the LRT. Given that DeFi integrations (specifically lending markets like Aave, Compound, and Morpho) price LRTs using NAV — rather than market price — a realized slashing event hurts the LRT and can impose risk on the lending markets which may propagate across DeFi.
Examining the Aave loan book reveals that debt collateralized by weETH has ballooned over the past six months. While the aggregate LTV (the ratio of debt to collateral) for assets such as wstETH has remained relatively consistent, we find that there are significantly larger weETH positions collateralizing ETH debt at higher LTVs. In particular, we find that over $1.5B of weETH is supplied at >92% LTV — implying these positions are supporting well over $1.3B of debt.
Distributions of LTV by collateral supplied: left is 2024-05-18, right is 2024-12-18. Note the increase in weETH collateral supplied at high LTVs since May.
Implications of liquidation
Given that the liquidation threshold on Aave for ETH debt against weETH is 95%, if the value of the ETH debt against the weETH collateral exceeds 95%, then the position will be open for liquidation. Since the slash reduces the NAV of the LRT on Aave, the slash can induce liquidation.
This means that half the position will be open to external liquidators to seize. Liquidators can repay half the ETH debt via flash loans to purchase the corresponding collateral at a discount — the liquidation bonus. Liquidation is generally atomic arbitrage in nature, so often this collateral is immediately converted back into ETH to repay the initial flash loan, completing the arbitrage.
This final step of converting the LRT collateral to ETH efficiently involves the LRT being sold on the secondary markets or being redeemed for the underlying ETH. However, both secondary liquidity and the capacity for redemptions (the withdrawal queue) are limited.
Simulation
Our simulation assesses the potential market impact and systemic risks resulting from a significant slash to weETH on the Aave loan book. We simulate how the resulting liquidation progresses and how it may lead to EL withdrawals.
Simulation mechanics and assumptions
We consider a stepwise evolution of our simulation. At t=0, the slash occurs, leading to large liquidation volume being absorbed, and at t > 0, the remaining liquidations process more slowly.
Immediate
- Slash Execution Leading to Liquidation
- The LRT is priced at NAV on lending protocol, so a decrease in NAV triggers liquidation for the positions with the highest LTV.
- Seized collateral from liquidation is converted back to ETH
- This is used to repay the ETH debt.
- The seized collateral from the liquidation is processed through the LRT’s immediate withdrawal buffer (or mechanism to facilitate immediate redemption) and through onchain liquidity adjusted for slippage.
- We assume that the onchain liquidity capacity for the LRT is depleted by 90% following this first batch of collateral selling.
- Exhaustion of Immediate Withdrawal Capacity
- Significant LRT dislocation rapidly depletes immediately available withdrawal capacity, amplifying systemic stress.
- Subsequent liquidations begin filling the overall withdrawal queue for non-immediate withdrawals.
At each timestep afterward
- Liquidations slow as secondary exits and immediate withdrawal capacity filled
- If slashing does not cause immediate insolvency, liquidations slow as dislocations exceed the liquidation bonus. This is coupled with further decay in the LRT’s market price.
- As liquidations slow, liquidity further dries up based on the increase in the withdrawal queue. If the queue size is approaching the remaining liquidation potential, then assume liquidity does not further decrease.
- LRT market price stabilization
- Assuming sufficient initial liquidity and confidence in withdrawal mechanisms, market stabilization is expected near a 1% dislocation before gradually decaying as liquidations are processed more slowly.
- At dislocations exceeding 1%, traders redeem via the standard withdrawal processes, but progress slows due to queue sizes.
- Traders taking a view that the withdrawal queue does not present excess risk likely buy up the LRT at dislocations >1% to redeem through the withdrawal queue.
- This triggers additional liquidations once the dislocation goes <1%.
- What can happen is a slow decay in LRT price as fewer withdrawal queue arbitrageurs arrive, bringing the dislocation back to 1%.
- L1 unstaking timelines (e.g., exiting 5,000–10,000 validators in ~6 days) may extend the withdrawal queue and lengthen debt resolution timelines, in particular slowing down the rate of arbitrageur arrival.
Simulation results
We find that immediate liquidation processing is in the range of ~500M, and subsequent liquidations decline dramatically. Data from stETH depegs in Spring 2022 suggested that depegs of a few percent take roughly a few hours to recover. We can proxy recovery time, after that initial dislocation by 1% after the slash, to be on the order of hours implying that every timestep in our simulation is one hour.
This implies that slashes for weETH of around 2% (the orange line) require almost 150 hours to process the entirety of liquidations on Aave. Slashes beyond 2% show increasing timeframes for completing liquidations. This increased timeframe may result in more depressed dislocations for longer periods of time.
Excess withdrawals due to queue arbitrageurs could contribute ~40% additional withdrawal on top of the amount getting liquidated.
Left - Cumulative amount liquidated for weETH over slashes of various magnitudes. Right - the cumulative amount withdrawn from EL (modeled as liquidation) + excess withdrawals. The difference in curvature between various slash thresholds can be drawn from the dependency of liquidity depletion on remaining liquidation potential; the linear evolution afterward comes from bounding the amount of liquidity that is depleted.
These simulation results are optimistic in nature given that we assume liquidity, while decreasing based on the pending simulated withdrawal queue with respect to remaining liquidations, is bounded from below. Otherwise, should this bound be removed and liquidity continuously get penalized, then this timeframe of liquidation likely demonstrates more concavity, and the rate of liquidation processing reaches some asymptote. This situation is not completely unreasonable since we can imagine situations involving the market’s lack of fidelity in the strength of the withdrawal queue, or even more extreme scenarios such as successive slashes.
Correlation to overall market returns
The above simulation did not take into account potential dislocations before the slashing event. These dislocations however may occur for a variety of reasons, including a general market downturn. Analysis of large market downturns (i.e. ETH dropping ≥ 10% in the span of an hour) often causes general discomfort across LSTs and other assets whose primary valuation depends on an underlying asset.
Left - LRT dislocations vs market returns. Right - dislocations of each LRT to NAV, where dark blue is ETH returns
Our analysis shows a roughly 0.2 beta between an ETH move and a corresponding LRT dislocation, excluding weETH. More explicitly, a 10% drawdown in ETH could cause a 2% dislocation to NAV for an LRT. These dislocations can cause further shocks to available liquidity for the LRT, fill withdrawal queues (as part of an initial shock due to the market downturn), and extend overall liquidation timelines. Examination of weETH, however, reveals that weETH is likely more resilient to market downturns due to its immediate withdrawal capacity, which may absorb LRT → ETH conversion otherwise facilitated through a DEX. This suggests that building robust capacity for immediate withdrawals is highly important to prevent further market-induced negative shocks that would precede a slash.
Size of immediate withdrawal capacity for weETH compared to weETH premium over time. Note that some instances of large dislocations are also accompanied by decreases in immediate withdrawal capacity
The impact on other LRTs
In the previous section we looked at how an isolated slash of weETH might lead to liquidations on Aave and how that might lead to subsequent LRT withdrawals and TVL decay on EigenLayer. weETH, despite being the largest LRT by size and liquidity, does not exist in isolation in the restaking ecosystem, and realized events associated with ether.fi affect adjacent LRTs. Essentially, a realized condition on LRT A can influence market activity on LRT B.
- This was most evident with the effect of the ether.fi Season 1 Airdrop on Renzo inflows and how stake migrated from ether.fi into Renzo, and further corroborated when the Renzo airdrop was below market expectation and dislocated the entire LRT space.
Change in weETH vs ezETH growth deltas vs Pendle PT volume differences between the two. Pendle PT volume generally increases with greater differences in implied yields on Pendle.
We hypothesize that slashing on one LRT (weETH) may trigger withdrawals on other LRTs (i.e. ezETH) since the slash adjusts the market’s understanding of expected global restaking yield. There can be a few factors that affect how strong this correlation might be — such as how long it took from day one of slashing for a slashing event to be realized.
If we consider restaking slashes as a Poisson process, then the market based on its understanding of slashing mechanics has a proxy \lambda_0^* for the number of slashes in a specific epoch. And based on those current yields upon day 0 of slash, the market can compute some reasonable prior of a risk-adjusted yield. Suppose a slash event occurs much earlier than what was expected with \lambda_0^* - implying that the market has completely underestimated slashing risk. More formally, \mathbb{P}(\lambda > \lambda_0^* | \text{first arrival at time t}) increases.
How violently the market adjusts its expectation for risk-adjusted restaking yield is unclear. For instance, whether the market chooses to completely disregard its previous understanding and assumption for slashing arrivals, or whether the market uses this new arrival to soften its previous estimate.
How this slash event then causes adjacent LRT withdrawal is dependent on the following.
- Breaking down \lambda_0^* into components of a natural operator failure rate adjusted by specific technological improvements by that particular LRT.
- Relevant benchmarks to equilibrium rates.
- EIGEN rewards on LST are 1.2% (on top of LST yield). Given that the borrow rate for ETH on Aave is 2.5% and the staking yield is 3.1%, the restaking yield for ETH is essentially at least two loops of a recursive LST collateralized / ETH debt position. This is an unknown risk [restaking] vs a known risk [L1] transformation. Of course, the people who loop LRTs instead of LSTs are leveraging this unknown restaking risk.
Ultimately, given the fact that real restaking rates that maintain TVL at equilibrium are still unclear, it remains to be seen how quickly LRT B would see withdrawals given a slash on LRT A. However, a market-perceived rate to be too high may overly penalize adjacent LRTs, causing larger than expected adjacent withdrawals in a slashing event, implying that sufficient restaking rewards is highly important.
Potential modifications to current mechanisms
Our simulations revealed that a slash of just 2% on weETH can lead to a TVL decay of ~$1B from EL, almost a 7x amplification of the actual slash amount.
Ultimately, robustness of the LRT to slashes requires the LRT having sufficient support on its functionality. The impact of slashes is ultimately dependent on the LRT’s withdrawal queue, rewards structure, NAV oracle / primary exchange rate module, secondary market liquidity, relative to the volume, any insurance mechanisms, among other traits. Weakness in these types of properties makes the LRT more fragile to excess effects from these drawdowns, and in particular how these drawdowns can be accentuated by broader acute market downturns.
While strengthening these characteristics can make the LRT more robust, we also offer a set of exploratory ideas that can help alleviate some of these punitive situations, which can protect lending protocols from excess risk especially within the time window of a slashing event.
Exploratory Ideas
On the lending market
- Implementing a killswitch to prevent borrows during times of uncertainty. One example of a potential killswitch implementation is our proposal regarding LSTs for Aave.
- Suppose we have market dislocation. There is some delay between the dislocation and understanding the event that caused this dislocation.
- We want to avoid adding excess risk during this latency period since we have yet to determine the events that caused the dislocation.
- Killswitch functionality can freeze future borrows against this LRT collateral.
- Should the dislocation actually be a precursor to a real slashing event, this killswitch would prevent adversarial excess borrows against this slashed LRT, ultimately reducing the number of liquidations and TVL decay from EL.
On graduated methods to release slashing
Redistributing slashed amounts back to LRTs to avoid forced liquidations on lending protocols.
- A phased release of slashing, i.e., something like EL redistributing slashed magnitudes across the entire operator set or giving them back to the LRTs.
- This can soften the blow and magnitude of liquidations and resulting TVL decay from EL.
- One caveat is that this may centralize stake into LRT operators / particular LRTs.
These ideas are exploratory in nature but do raise the question of finding the optimal mechanisms to introduce, applicable on both the restaking front and the broader DeFi ecosystem, to ensure the safe release of slashing functionality.