[MERGED] ELIP-003: User Access Management (UAM)

Protocol Council ELIPs
,
1

Hi everyone – more ELIPs (and more to come)!

Introducing ELIP-003: UAM! User Access Management (UAM) is a protocol-level feature in EigenLayer enhancing key management for Operators and AVS developers, such as allowing secure key rotation, revocation, and recovery as well as unlocking significantly more modular architecture for AVSs and Operators.

UAM will simplify AVS architecture in key ways, primarily through splitting of responsibilities of the ServiceManager . The protocol now demarcates specific functionality the root admin keys may appoint to new addresses, either EOAs or contracts. Similarly, admin keys themselves may be appointed or rotated. This property enables more robust key management, but also a separation of concerns by opening up the design space for upstream, modular contracts interfacing with the core EigenLayer protocol!

This protocol improvement is live on Testnet now – and is intended to ship with the slashing release on Mainnet.

Please let us know what you think! We are very curious how AVSs and Operators will unlock interesting modular designs and simplify their codebases.

As usual, reach us with feedback.

3 Likes
2

Hey everyone, exciting news with the introduction of ELIP-003: UAM! This protocol-level feature is going to revolutionize key management for Operators and AVS developers by simplifying tasks like key rotation, revocation, and recovery. It opens up a lot of possibilities for a more modular architecture for AVSs and Operators. You can read more about it and see how it will shape future designs on key management. Can’t wait to see what new ideas come from this update! Let us know your thoughts.

3

On Apr-17-2025 at Apr-17-2025 10:30:11 PM UTC ELIP-003 was successfully executed. Here is an overview of the implementation:

  1. A transaction to execute the previously-queued timelock action was proposed to the Protocol Council multisig. This initial proposal was performed using Zeus, a tool developed by EigenLabs to aid in deployments and administrative actions (soon to be open source!). It followed the logic in the scripts within this folder. The previously-queued action can be found in the event logs of this transaction.
  2. Protocol Council members proceeded to sign the proposed action via the (Gnosis) Safe UI, with the last (i.e. 3rd) signer executing the action.
  3. Upon execution, the action triggered an upgrade of the:
    1. AVS Directory (0x135dda560e946695d6f155dacafc6f1f25c1f5af) to the implementation deployed at 0xa396d855d70e1a1ec1a0199adb9845096683b6a2
    2. Delegation Manager (0x39053d51b77dc0d36036fc1fcc8cb819df8ef37a) to the implementation deployed at 0xa75112d1df37fa53a431525cd47a7d7facea7e73
    3. Rewards Coordinator (0x7750d328b314effa365a0402ccfd489b80b0adda) to the implementation deployed at 0xa505c0116ad65071f0130061f94745b7853220ab
    4. Strategy Manager (0x858646372cc42e1a627fce94aa7a7033e7cf075a) to the implementation deployed at 0xba4b2b8a076851a3044882493c2e36503d50b925
    5. All EigenPods (beacon at 0x5a2a4f2f3c18f09179b6703e63d9edd165909073) to the implementation deployed at 0xb132a8dad03a507f1b9d2f467a4936df2161c63e
    6. EigenPod Manager (0x91e677b07f7af907ec9a428aafa9fc14a0d3a338) to the implementation deployed at 0x9801266cbbbe1e94bb9daf7de8d61528f49cec77
    7. The EigenStrategy (0xacb55c530acdb2849e6d4f36992cd8c9d50ed8f7) to the implementation deployed at 0x90b074ddd680bd06c72e28b09231a0f848205729
    8. All factory-deployed Strategy contracts (beacon at 0x0ed6703c298d28ae0878d1b28e88ca87f9662fe9) to the implementation deployed at 0x0ec17ef9c00f360db28ca8008684a4796b11e456
    9. Strategy Factory (0x5e4c39ad7a3e881585e383db9827eb4811f6f647) to the implementation deployed at 0x1b97d8f963179c0e17e5f3d85cdfd9a31a49bc66
    10. All “legacy Strategies” (deployed before the Strategy Factory’s existence – see https://github.com/Layr-Labs/eigenlayer-contracts-zeus-metadata/blob/f3e848dbebe9ce8b1a45392c61b2f1edf7d54631/environment/mainnet/manifest.json#L280-L408 for the full list of addresses) to the implementation deployed at 0xafda870d4a94b9444f9f22a0e61806178b6bf178

Before signing, all Protocol Council members reviewed a Tenderly simulation for confirmation of the above and used pcaversaccio’s tool (https://github.com/pcaversaccio/safe-tx-hashes-util) and OpenZeppelin’s similar tool (https://safeutils.openzeppelin.com/) to check for matching hashes on signed data.