OAK — OnChain Attack Knowledge

Worked example · 2024-05

Ether.fi weETH liquid-restaking-token discount-to-NAV event — Ethereum L1 — 2024-05

Loss
aggregate mid-eight-figures USD in unrealised mark-to-market losses, looped-leverage liquidation cascades, and forced secondary-market exits for weETH holders during the May 2024 discount period. Unlike the Renzo ezETH April 2024 depeg (which reached ~79% intra-hour trough), the weETH discount was more contained — approximately 5–12% discount to NAV sustained over several days — but the looped-leverage cohort on Pendle, Gearbox, and Morpho absorbed material liquidations as the DEX-price-to-NAV divergence crossed liquidation thresholds on lending venues. Individual liquidation losses ranged from low-five-figures to mid-six-figures USD depending on leverage ratios and entry points. Ether.fi's native-redemption path (withdrawal queue) was operational during the event, which capped the discount amplitude relative to the Renzo case, but the redemption queue's multi-day escrow created a structural window where DEX price discovery diverged from NAV.
OAK Techniques observed
OAK-T14.004 (Liquid Restaking Token Pricing Manipulation — the weETH discount-to-NAV event exercised the withdrawal-queue-gaming and DEX-price-vs-NAV-arbitrage sub-primitives; the Ether.fi withdrawal queue's fixed redemption rate during the escrow period created a spread against the floating DEX price that arbitrageurs could exploit). OAK-T14.003 (Restaking Cascading Risk — sub-case (b) LRT depeg cascade; the discount propagated through Pendle YT/PT markets, Gearbox looped-leverage facilities, and Morpho lending vaults, triggering a smaller-scale cascade than Renzo April 2024 but structurally identical in propagation geometry). OAK-T9.001 (Oracle Price Manipulation — contributing; lending-market oracles anchored to weETH DEX spot propagated the discount into liquidation triggers at venues that served the looped-leverage cohort).
Attribution
unattributed No external attacker; the discount was driven by a combination of (a) Ether.fi's airdrop-season dynamics (ether.fi ETHFI token farming concluded, reducing marginal incentive to hold weETH), (b) EigenLayer withdrawal-queue dynamics (the EigenLayer mainnet withdrawal queue had opened, creating a redemption-rate anchor that lagged DEX price discovery), and (c) LRT-sector rotation as capital shifted between Renzo, Ether.fi, Kelp, and Puffer LRTs during the points-program window. The event is a mechanism-design-driven cohort-harm pattern, not an attacker-driven exploitation.
Key teaching point
A functional native-redemption path (Ether.fi's withdrawal queue) caps but does not eliminate the LRT discount-to-NAV surface — the escrow period creates a structural window where DEX price discovery floats relative to the fixed redemption rate, and looped-leverage positions that are marked to the DEX price liquidate before redemption completes. The weETH May 2024 event is the second canonical T14.004 anchor after Renzo April 2024, demonstrating that the LRT pricing-manipulation surface persists even when native redemption is operational — the manipulation primitive shifts from "no redemption path" (Renzo) to "redemption-queue-escrow-arbitrage" (Ether.fi).

Summary

Ether.fi launched in late 2023 as one of the earliest EigenLayer-integrated liquid-restaking protocols on Ethereum L1. Users deposited ETH and received weETH (wrapped eETH) — a liquid-restaking token redeemable for the underlying ETH-plus-restaking-yield. Unlike Renzo at the time of its April 2024 depeg, Ether.fi had shipped a functional native-redemption path (withdrawal queue) by May 2024, meaning weETH holders could exit to ETH via the queue rather than being forced to sell on secondary markets. By May 2024, Ether.fi had accumulated over $4B in TVL, with weETH integrated into Pendle (yield-trading markets with PT/YT tokenisation), Gearbox (looped-leverage facilities), and Morpho Blue (looped vault strategies).

In May 2024, two structural forces converged to produce a sustained weETH discount to NAV. First, the Ether.fi ETHFI governance token airdrop season concluded in March 2024, and the EigenLayer points program (which awarded restaking points to weETH holders) entered its final phase. Holders who had accumulated weETH primarily for airdrop-farming incentives began rotating out of weETH positions into competing LRTs (Renzo ezETH, Kelp rsETH, Puffer pufETH) whose points programs still had marginal incentive value. Second, the EigenLayer mainnet withdrawal queue had opened, creating a redemption-rate anchor: weETH could be redeemed for ETH via the queue at a fixed rate over a multi-day escrow period. The DEX spot price for weETH/ETH floated while the redemption rate was fixed during the escrow window, creating a structural spread.

The spread manifested as a 5–12% weETH discount to NAV on Uniswap V3 and Curve pools sustained over several days in May 2024. The discount was smaller in amplitude than the Renzo April 2024 depeg (~79% trough) because the native-redemption path provided an arbitrage floor: arbitrageurs could buy discounted weETH on DEX, enter the redemption queue, and capture the spread upon redemption. However, the multi-day escrow period meant the arbitrage was not instantaneous — the spread persisted as long as the redemption queue's throughput was saturated and the escrow period exceeded arbitrageurs' time-preference horizon.

The discount propagated into the looped-leverage cohort through the same cascade geometry as Renzo April 2024. Pendle weETH YT/PT markets repriced to reflect the discount, with PT-weETH trading at a wider discount to face value. Gearbox looped-leverage positions (weETH-collateralised ETH borrowing loops) liquidated as the weETH/ETH DEX price fell below the Gearbox oracle's liquidation threshold. Morpho Blue weETH-collateralised vaults saw borrower liquidations as the Morpho oracle (anchored to weETH DEX spot) registered the discount. The cascade was smaller in scale than Renzo (~$56M+) because the discount amplitude was shallower and the native-redemption path absorbed some sell pressure, but the structural geometry was identical.

Ether.fi's withdrawal queue processed redemptions over the multi-day window, and the discount converged toward NAV as the queue absorbed sell pressure and as LRT-sector rotation completed. The looped-leverage liquidations were final by block resolution; affected borrowers absorbed the realised loss. No operator-make-whole or community-compensation was provided to the liquidated cohort.

Timeline (UTC)

When Event OAK ref
2024-Q1 Ether.fi ETHFI token airdrop season concludes; weETH holders receive ETHFI governance tokens; post-airdrop marginal incentive to hold weETH declines (standing T14.004 surface; airdrop-season-end reduces holder stickiness)
2024-04-24 Renzo ezETH depeg event (~$56M cascade); LRT sector sentiment deteriorates; capital rotation between LRT protocols accelerates (T14.003 (b) cross-LRT contagion context)
2024-05 (early) EigenLayer withdrawal queue opens on mainnet; weETH native-redemption path becomes operational; redemption rate fixed during multi-day escrow, creating structural spread against DEX spot (T14.004 withdrawal-queue-gaming surface created)
2024-05 (mid) weETH discount to NAV emerges on Uniswap V3 and Curve pools; 5–12% discount sustained over several days; driven by LRT-sector rotation + redemption-queue throughput saturation T14.004 (DEX-price-vs-NAV divergence)
2024-05 (mid) Pendle weETH YT/PT markets reprice to reflect discount; PT-weETH trades at wider discount to face value; Gearbox looped-leverage positions liquidate as weETH/ETH DEX price crosses liquidation thresholds T14.003 (b) cascade propagation through yield-derivative and lending venues
2024-05 (mid) Morpho Blue weETH-collateralised vaults liquidate borrowers; oracle anchored to DEX spot propagates discount into liquidation triggers T9.001 (oracle propagation) + T14.003 (b)
2024-05 (late) weETH discount converges toward NAV as Ether.fi withdrawal queue processes redemptions and LRT-sector rotation completes; looped-leverage liquidations finalised (market-clearing recovery; liquidations irreversible)
2024-06 onward Ether.fi and LRT-sector methodology updates: redemption-queue-throughput transparency, withdrawal-queue-depth dashboards, and LTV parameter review across integrating lending venues (defender-side mitigation propagation)

Realised extraction

Aggregate mid-eight-figures USD in unrealised mark-to-market losses, looped-leverage liquidation cascades, and forced secondary-market exits. The loss is distributed across the weETH holder cohort (those who sold at a discount on DEX rather than waiting for redemption-queue processing) and the looped-leverage borrower cohort (Gearbox and Morpho liquidations). The redemption-queue path provided an exit for patient holders (those willing to wait the multi-day escrow), but leveraged borrowers marked to the DEX spot price did not have the option to wait — their positions liquidated when the DEX price crossed the liquidation threshold, regardless of the redemption-rate anchor.

Public references

  • Ether.fi official documentation — weETH redemption mechanism, withdrawal-queue design, and NAV calculation methodology
  • Pendle weETH YT/PT market data — weETH discount propagation through yield-derivative markets (May 2024)
  • Gearbox and Morpho Blue liquidation event data — weETH-collateralised position liquidations during the May 2024 discount window
  • Cross-reference: T14.004 at techniques/T14.004-liquid-restaking-token-pricing-manipulation.md
  • Cross-reference: examples/2024-04-renzo-ezeth-depeg.md — Renzo ezETH April 2024 depeg (first T14.004 canonical anchor; no-native-redemption variant)
  • Cross-reference: examples/2024-06-kelp-rseth-depeg.md — Kelp rsETH June 2024 depeg (second T14.004 canonical anchor; composition-change-triggered variant)
  • [steakhouselrt2024] — Steakhouse Financial LRT methodology; NAV-calculation and oracle-update-cadence documentation
  • [gauntletrestaking2024] — Gauntlet restaking-economy analysis; LRT collateral-health methodology

Techniques demonstrated (3)