# Collateral Risk Assessment - Renzo Restaked ETH (ezETH)

**Useful Links**
- Website: renzoprotocol.com
- Documentation: docs.renzoprotocol.com
- Social: twitter.com/RenzoProtocol
- Contracts: [ezETH](https://etherscan.io/token/0xbf5495Efe5DB9ce00f80364C8B423567e58d2110) | [Restake Manager](https://etherscan.io/address/0x74a09653A083691711cF8215a6ab074BB4e99ef5)
- Markets: Balancer ([ezETH/WETH ETH](https://app.balancer.fi/#/ethereum/pool/0x596192bb6e41802428ac943d2f1476c1af25cc0e000000000000000000000659), [ezETH/WETH ARB](https://app.balancer.fi/#/arbitrum/pool/0xb61371ab661b1acec81c699854d2f911070c059e000000000000000000000516), [weETH/ezETH/rswETH](https://app.balancer.fi/#/ethereum/pool/0x848a5564158d84b8a8fb68ab5d004fae11619a5400000000000000000000066a)) | Curve ([ezETH/WETH](https://curve.fi/#/ethereum/pools/factory-stable-ng-79/deposit)) | UniswapV3 ([ezETH/WETH](https://info.uniswap.org/#/tokens/0xbf5495efe5db9ce00f80364c8b423567e58d2110))
- Dashboards: [RenzoProtocol Dune Dashboard](https://dune.com/renzoprotocol/renzo) | [maybeYonas Dune Dashboard](https://dune.com/maybeYonas/renzo-protocol)

# Introduction

**This report is conducted by the Prisma independent risk and research team operated by [Llama Risk](https://cryptorisks.substack.com/) as part of a series on LRT collateral risk assessments. In this report, we examine Renzo's ezETH.**

This report will comprehensively cover all relevant risk factors of Renzo's ezETH for collateral onboarding. Our approach involves both quantitative and qualitative analysis to help determine whether the collateral can be safely onboarded and to what extent there should be restrictions on the Protocol's exposure to the collateral.

As Prisma will be onboarding a variety of LRTs as collateral, our review involves comparative analysis to determine suitability as collateral. Risks are categorized into:

- **Market Risk** - risks related to market liquidity and volatility
- **Technology Risk** - risks related to smart contracts, dependencies, and Oracle price feeds
- **Counterparty Risk** - risks related to governance, centralization vectors, and legal/regulatory considerations

These risk categories will be summarized in the final section of this report and are meant to assist tokenholders in their determination around ezETH onboarding and setting suitable parameters.

# Section 1: Protocol Fundamentals

This section addresses the fundamentals of the proposed collateral. It is essential to convey (1) the value proposition of ezETH, and (2) the overall architecture of the Protocol. This section contains descriptive elements that cannot be quantified and act as an explanatory introduction to the collateral.

This section is divided into two sub-sections:

- 1.1: Description of the Protocol
- 1.2: System Architecture

## 1.1 Description of the Protocol

Renzo is a Liquid Restaking Token (LRT) provider and Strategy Manager, seamlessly interfacing with EigenLayer to simplify the complex dynamics between users and EigenLayer node operators. With its beta mainnet launched on December 18, 2023, [Renzo's platform](https://www.renzoprotocol.com) offers a user-friendly liquid restaking solution. Users have the flexibility to deposit any amount of ETH or select quantities of LSDs (WBETH and stETH for the time being), with ambitions to broaden support for additional LSDs in the near future. Currently, the platform does not facilitate withdrawals, and a lack of public source code or deployed contract functions for these actions implies that exiting an ezETH position is presently confined to DEX liquidity or OTC transactions.

By the 14th of January 2024, the Renzo Protocol raised $3.2 million in seed funding at a valuation of $25 million. This seed funding round was led by Maven11 and participated in by OKX Ventures, Robot Ventures, Protagonist, Bitscale Capital, Re7 Capital, Mantle Network, and Karatage, among others. On the 21st of February 2024, Binance Labs also invested in the Renzo Protocol with an undisclosed amount.

Source: [RootData](https://www.rootdata.com/Projects/detail/Renzo%20Protocol?k=OTk0NA%3D%3D)

Renzo's node operator set is deliberately permissioned, featuring five professional node operators to date: [Figment](https://figment.io/), [p2p.org](https://p2p.org/), [Luganodes](https://www.luganodes.com/), [HashKey](https://www.hashkey.cloud/), and [Pier Two](https://piertwo.com/). The protocol dynamically allocates pooled tokens among these node operators, based on predetermined weightings for each.

Depositing native ETH to Renzo triggers a process where the ETH is earmarked for staking through a validator node on the Ethereum Beacon chain. This ETH is temporarily stored in the [DepositQueue](https://etherscan.io/address/0xf2F305D14DCD8aaef887E0428B3c9534795D0d60) contract until reaching the 32 ETH threshold required for direct transfer to the Beacon Chain Deposit Contract. At this juncture, withdrawal credentials are aligned with the EigenPod in EigenLayer, ensuring the staked ETH not only garners Ethereum validator rewards but also secures AVSs within EigenLayer. In the event of a validator node shutdown, the EigenPod reserves the right to retain a portion of the ETH as a safeguard against potential slashing incidents.

For LSD deposits, Renzo facilitates immediate restaking within EigenLayer, assigning them to the designated node operator. Renzo claims that the direct transfer of all restaked points accrued in EigenLayer to the users is guaranteed, foregoing any fees. Furthermore, should Renzo users qualify for airdrops from other projects, they are assured receipt of the full airdrop benefits. To foster community engagement and protocol growth, Renzo introduces Renzo Points as rewards for user contributions, be it through DEX liquidity provision or restaking efforts. Additionally, a referral program enhances user rewards with additional Renzo Points for every new participant they successfully introduce to the platform who engages in restaking ETH.

**Key metrics (as of March 31, 2024):**

- Circulating supply: [603,042](https://etherscan.io/token/0xbf5495efe5db9ce00f80364c8b423567e58d2110) ezETH
- Holders (unique addresses): [23,115](https://etherscan.io/token/0xbf5495efe5db9ce00f80364c8b423567e58d2110)
- Liquid stakers: [38,394](https://dune.com/queries/3334141/5585669) unique ezETH depositors
- Market share of ETH staked: [~1.5%](https://dune.com/hildobby/eth2-staking)
- Number of validators: [~1M](https://dune.com/hildobby/eth2-staking)
- Number of node operators: 5 professional permissioned

### 1.1.1 Underlying Collateral

ezETH is a yieldbearing receipt token, mirroring the conceptual framework of [Compound’s cTokens](https://docs.compound.finance/v2/ctokens/#ctokens). It maintains a soft peg to ETH, with its foundation firmly rooted in collateral comprising staked ETH and select LSDs. Currently, Renzo accepts WBETH and stETH within its supported LSDs, with an ambitious roadmap to extend coverage to a broader spectrum of LSDs in due time.

The protocol dictates that for each deposit of LSD or ETH, an equivalent value of ezETH is minted. This minting calculation is anchored in the ETH-equivalent value of the input asset, juxtaposed against the collective ETH-value of all deposits and the circulating supply of ezETH tokens. In essence, the minting mechanism is predicated on the book value of ezETH, ensuring a transparent and equitable token issuance process.

Compliance with the ERC20 standard renders ezETH a versatile token composable within DeFi, enabling its seamless integration and utility across a myriad of DeFi protocols.

### 1.1.2 Yield Accrual Mechanism

ezETH is a yieldbearing token, offering users the opportunity to accrue interest. This accrual is facilitated through an appreciating exchange rate of ezETH against its underlying assets, ensuring that the value of ezETH incrementally increases over time in relation to the collateral it represents.

Currently, the staking yield primarily originates from Ethereum validators. However, with the activation of Actively Validated Services (AVSs) on EigenLayer, Renzo’s Node operators are set to harness these new avenues to augment the restaking yield landscape.

The mechanics of capturing increases in the underlying assets are managed by the `RewardHandler` contract. This contract plays a pivotal role in channeling native ETH rewards, accrued from validator node activities on the execution layer, directly into the `DepositQueue` contract. Once in the `DepositQueue`, these rewards are earmarked for restaking, effectively perpetuating the cycle of yield generation. This streamlined process ensures that the value of ezETH remains dynamically aligned with the performance and rewards generated by its underlying assets.

The `RewardHandler` can also accommodate ERC20 token rewards, with the caveat that it only processes tokens eligible for restaking. This constraint introduces a notable limitation, particularly in the context of potential collaborations with AVSs that might favor validators retaining their tokens instead of liquidating them upon acquisition. This specificity in the `RewardHandler` contract's functionality could inadvertently narrow the spectrum of AVS partnerships, especially with those seeking to encourage long-term holding strategies among validators.

### 1.1.3 Provider Fee

Renzo protocol incorporates a singular fee structure, applying a 10% performance fee exclusively on rewards funneled into the `DepositQueue` contract. This fee mechanism is designed to align the protocol's interests with those of its users by focusing on the additional value generated through its operations.

As for the allocation of these collected fees, the protocol is yet to finalize the distribution mechanism. This aspect remains under development, with plans to detail the beneficiaries of the fee distribution in due course, ensuring transparency and fairness in the protocol's economic model.

The fee structure, including the specific percentage levied, is transparent and verifiable through the `DepositQueue` contract's storage. This ensures that all participants have access to clear, unambiguous information regarding the fee mechanism in place.

For further verification and transparency, the fee percentage can be confirmed by reviewing the contract storage details provided through [evm.storage](https://evm.storage/):

Source: [evm.storage](https://evm.storage/eth/19528377/0xf2f305d14dcd8aaef887e0428b3c9534795d0d60/feeBasisPoints#table) | Date: March 28th, 2024

This approach ensures that Renzo remains accountable to its users, offering a clear insight into the operational and financial aspects of the protocol.

### 1.1.4 Node Operator Set

Renzo's node operator infrastructure is deliberately designed as a fully permissioned ecosystem, currently incorporating five professional node operators: [Figment](https://figment.io/), [p2p.org](https://p2p.org/), [Luganodes](https://www.luganodes.com/), [HashKey](https://www.hashkey.cloud/), and [Pier Two](https://piertwo.com/).

Performance metrics are a testament to node operators' competency, with all of Renzo's node operators securing a Rated Effectiveness Rating (RAVER) above 95%, as per the latest evaluations by [rated.network](https://www.rated.network/). This high RAVER score underscores their consistent and efficient performance in fulfilling validator duties over time. For those interested in a deeper dive into their performance and the evaluation criteria, [Rated Network’s documentation](https://docs.rated.network/methodologies/ethereum-beacon-chain/rated-effectiveness-rating) offers comprehensive insights into the RAVER methodology.

While the current node operator set is compact, Renzo sees potential for future expansions, signaling an openness to augmenting the node operator roster, enhancing network resilience, and diversifying operational capabilities.

At the current stage, there appears to be a lack of intention to broaden the network to include non-professional node operators. Doing so would surely enhance decentralization and address the drawbacks associated with dependence on a small number of providers.

### 1.1.5 Validator Selection

Renzo Protocol accumulates ETH deposits until it gathers a sufficient amount of 32 ETH. Then, an authorized admin triggers the staking process, specifying the validator's public key and other required parameters. 

The `RestakeManager` contract maintains a list of Operator Delegators and their allocations (in basis points). It allows administrative functions to add, remove, or update the allocations for these Operator Delegators. The selection of an Operator Delegator for depositing or withdrawing is determined based on their current Total Value Locked (TVL) compared to their allocated basis points of the total TVL of the protocol. This process is evident in the `chooseOperatorDelegatorForDeposit` and `chooseOperatorDelegatorForWithdraw` functions.

Source: [ContractReader](https://www.contractreader.io/contract/mainnet/0x6921c63fcf9796c9733690804e116be3520ba468)

The specific logic to pick the most suitable Operator Delegator is defined by `StratetgyManager` contract.

### 1.1.6 AVS Selection

Renzo will collaborate with Operators to delineate the requisite AVSs to be activated, contingent upon specific preconditions being fulfilled by the AVS. Initially, the decision of opting in or out of AVSs is anticipated to be vested in the protocol's governance structure. The documentation projects a snapshot vote to establish preliminary processes which, upon successful validation and testing, will transition to on-chain voting. Currently the AVS underwriting remain ambiguous, primarily due to the incomplete establishment of the governance model and the absence of a functional DAO.

### 1.1.7 Validator Collateralization

In the Renzo ecosystem, professional node operators do not have a collateralization requirement. Their collaboration with Renzo is underpinned by formal agreements, which serve as a testament to the mutual trust and reliance on the operators' professional standing and integrity to meet their obligations.

This arrangement places significant emphasis on the professional reputations and operational histories of the node operators, entrusting them with the responsibility to perform in alignment with Renzo's standards. In scenarios where these operators deviate from their commitments or underperform, Renzo retains the right to initiate legal proceedings. These commitments often encompass provisions for liability limitations, arbitration processes, and jurisdictional nuances, ensuring clarity and mutual understanding regarding the resolution of disputes.

Looking ahead, Renzo is contemplating a shift towards a more secured model of operation. In a recent discourse, Lucas from the Renzo team unveiled plans to introduce a mechanism for collateralization involving the protocol's forthcoming governance token. This development, if achieved as highlighted in [a presentation](https://www.youtube.com/watch?v=eF9nFbieWQA), marks a pivotal step towards enhancing the security and reliability of node operator engagements with Renzo.

### 1.1.8 Governance Model

Currently, Renzo's governance structure lacks a Decentralized Autonomous Organization (DAO) and a governance token (although the REZ token was recently announced in April 2024), which results in its governance being centralized under the stewardship of the Renzo team. The platform's legal establishment complies with the traditional legal and operational frameworks that govern conventional business entities. Documentation from Renzo hints at a strategic pivot towards embracing full on-chain governance in the forthcoming period, signaling a transition towards a more decentralized governance model.

The governance is centralized within a [3/5 multi-signature wallet](https://etherscan.io/address/0xD1e6626310fD54Eceb5b9a51dA2eC329D6D4B68A) for key protocol decisions and updates. While Renzo intends to distribute authority, the current model rests on the assumption of trust among the anonymous signatories. This raises security concerns, as the signatories' identities and their relationships remain undisclosed, potentially allowing for unilateral control if they represent a single entity or closely aligned parties.

## 1.2 System Architecture

### 1.2.1 Network Architecture Overview

Renzo's network architecture is designed to streamline the deposit of native ETH or LSDs by users, facilitating their seamless exchange for ezETH. This process, foundational to the Renzo Protocol, is visually depicted in the following diagram, offering a clear and concise illustration of the operational flow.

Source: [Renzo documentation](https://docs.renzoprotocol.com/docs/renzo/how-do-lrts-work)

The mechanics of the deposit and exchange process exhibit slight variations depending on the type of deposit made—be it native ETH or an LSD. This nuanced approach ensures that the protocol accommodates different asset types efficiently while maintaining the integrity and fluidity of the exchange mechanism.

Further expanding its horizon, the Renzo Protocol ventures into the realm of cross-chain functionality, enabling the restaking of native ETH from partnered chains. By enabling such features Renzo not only broadens its utility and accessibility but taps into the ascending cross-chain interoperability.

The forthcoming section will delve into a more detailed exploration of the system's architecture, providing a deeper understanding of the intricacies that underpin Renzo's network design.

### 1.2.2 Architecture Diagram

**Ethereum Mainnet perspective**
This section delineates the core architecture of the Renzo system as operationalized on the Ethereum Mainnet, laying the groundwork for a comprehensive understanding of its functional mechanisms.

The principal gateway for user interaction within the Renzo protocol is through the [RestakeManager](https://etherscan.io/address/0x6921c63fcf9796c9733690804e116be3520ba468) contract. This contract facilitates both the deposit of value into EigenLayer and the withdrawal of value back to the user, acting as the central node for user engagement with the protocol.

<img src="https://hackmd.io/_uploads/BJJWdopW0.png" width="400"/>

Source: [Renzo GitHub](https://github.com/Renzo-Protocol/contracts-public)

**Depositing Native ETH**
Users wishing to deposit native ETH into Renzo initiate the transaction by invoking the `RestakeManager.depositETH()` function. This function dynamically calculates the amount of ezETH to mint in exchange, based on the current ETH valuation and the existing supply of ezETH. The minted ezETH is then credited to the user, and the deposited ETH is routed to the `DepositQueue`. Upon accumulation of at least 32 ETH in the DepositQueue, a designated privileged account is authorized to trigger the `DepositQueue.stakeEthFromQueue()` function, restaking the aggregated ETH under a specified delegate within the EigenPod.

**Depositing LSDs**
For LSD deposits, users utilize the `RestakeManager.deposit()` function. This function assesses the ETH-denominated value of the deposited LSD, calculates the corresponding ezETH minting amount, and allocates the LSD to the chosen delegate through the EigenLayer strategy contract. This allocation is executed using the `OperatorDelegator` contract, which, as a dedicated entity, interacts with EigenLayer and facilitates the restaking process under a specific operator.

**User Withdrawals**
As of the current implementation, the `RestakeManager` contract does not support direct user withdrawals. Consequently, the primary avenues for exiting an ezETH position are through DEX liquidity pools or through OTC transactions.

**Withdrawals from Node Operators**
The `OperatorDelegator` contract enables withdrawal functionalities for privileged accounts, allowing for the specification of recipient addresses for outgoing funds. This level of autonomy, afforded to a select few, raises substantial security concerns, exposing the protocol to potential mismanagement or malicious diversion of funds.

**Handling Rewards**
Renzo is equipped to manage rewards in the forms of ETH and select ERC20 tokens, which are earmarked for restaking into EigenLayer. ETH rewards are initially deposited into the `RewardHandler` contract and subsequently funneled into the `DepositQueue`. In contrast, ERC20 token rewards are directly channeled into the `DepositQueue` contract. This reward mechanism highlights Renzo's strategic focus on leveraging rewards that are compatible with restaking, though it also imposes limitations on potential collaborations with AVSs preferring alternative reward dynamics.

**Cross chain perspective**
In step towards enhancing its cross-chain functionality, Renzo Protocol has partnered with [Connext Network](https://www.connext.network/) to facilitate native ETH and, prospectively, LSD restaking from partnered chains. Their collaboration marks a significant extension of Renzo's capabilities, offering users the ability to engage in cross-chain restaking activities.

The cross-chain restaking process begins when users deposit wrapped Ethereum into the `xRenzoDeposit` contract on the partner chains. Upon deposit, **xezETH** tokens are minted immediately as a representation of the users' staked assets. The `xRenzoDeposit` contract periodically initiate a bridge transaction via Connext, effectively transferring all collected WETH to the Ethereum mainnet's `xRenzoBridge` contract.

<img src="https://hackmd.io/_uploads/Hy3zOo6-A.png" width="400"/>

Source: [Renzo GitHub](https://github.com/Renzo-Protocol/contracts-public)

Upon receipt, the `xRenzoBridge` contract invokes its `bridgeDeposit()` function, converting WETH back into native ETH. This ETH is then channeled into the `RestakeManager` for restaking, with the corresponding ezETH tokens sent to the `Lockbox` contract for burning, signifying the completion of the cross-chain restaking process.

<img src="https://hackmd.io/_uploads/BJQNdspZ0.png" width="400"/>

Source: [Renzo GitHub](https://github.com/Renzo-Protocol/contracts-public)

Periodically, the `xRenzoBridge` sends the current book price of ezETH, denominated in ETH, using Chainlink's CCIP, to the partnered chains, which ensures up-to-date pricing information.

### 1.2.3 Key Components

**RestakeManager Contract**
The main entrypoint for external users into the protocol. Users will interact with this contract to deposit and withdraw value into and from EigenLayer. Ownership of deposited funds is tracked via the ezETH token, which is handled by this contract.

**DepositQueue Contract**
Handles deposits of funds from the Renzo ecosystem into EigenLayer, deduction of fees, and restaking of ETH or ERC20 rewards into EigenLayer.

**OperatorDelegator Contract**
This contract is responsible for interacting with Eigenlayer. Each of these contracts deployed will be delegated to one specific node operator. This contract can handle multiple ERC20 tokens, all of which will be delegated to the same operator. Each supported ERC20 token will be pointed at a single Strategy contract in EigenLayer. Only the RestakeManager should be interacting with this contract for EigenLayer interactions.

**xRenzoDeposit Contract**
Tokens are sent to this contract via `deposit()`, xezETH is minted for the user, and funds are batched and bridged down to the L1 for depositing into the Renzo Protocol. Any ezETH minted on the L1 will be locked in the `lockbox` for unwrapping at a later time with xezETH.

# Section 2: Performance Analysis

This section evaluates ezETH from a quantitative perspective. It analyzes token usage and competitive metrics and addresses any subsidized economic activity.

This section is divided into three sub-sections:

- 2.1: Usage Metrics
- 2.2: Competitive Analysis Metrics
- 2.3: Subsidization of Economic Activity

## 2.1 Usage Metrics

### 2.1.1 Total Value Locked (TVL)

Renzo has quickly ascended to become the second-largest project by TVL among LRT providers. This remarkable growth trajectory was sparked by the launch of ezETH in December 2023, which catalyzed in its TVL surpassing 980k ETH or $3 billion by April 16, 2024, as reported by DefiLlama.

<iframe width="640px" height="360px" src="https://defillama.com/chart/protocol/renzo?denomination=ETH&theme=light" title="DefiLlama" frameborder="0"></iframe>

Source: [DeFiLlama](https://defillama.com/protocol/renzo)

This growth is intricately tied to the anticipation of EigenLayer, especially given that it has reached its capacity for LSD deposits. Consequently, this places Renzo in a pivotal position, as it is one of the few to offer an avenue for native restaking. By acting as a bridge to EigenLayer's native restaking functionalities, Renzo not only democratizes access to restaking by accommodating fractional ETH deposits but also enriches the user experience by integrating rewards in the form of EigenLayer loyalty points.

### 2.1.2 Transaction Volume

The daily transaction volume and transfer count for ezETH at the contract level are depicted in the following graph:

Source: [Etherscan](https://etherscan.io/token/0xbf5495efe5db9ce00f80364c8b423567e58d2110#tokenAnalytics) | Date: March 31, 2024

### 2.1.3 Average Deposit Size

The average deposit size in ETH is captured below:

source: [Dune](https://dune.com/queries/3334134/5612569) - March 31, 2024

### 2.1.4 Active Addresses/Users

<!--
(source: [Dune Analytics](https://dune.com/maybeYonas/renzo-protocol))
-->

The following chart tracks activity by showing the daily unique depositing addresses into Renzo along with returning depositors.

Source: [Dune Analytics](https://dune.com/maybeYonas/renzo-protocol)

The following chart tracks the cumulative growth of depositing addresses over the past 90 days.

Source: [Dune Analytics](https://dune.com/maybeYonas/renzo-protocol)

| Time period | Growth % |
| --- | --- |
| 7 days | 9.31% |
| 30 days | 84.39% |
| 90 days | 1704.11% |

### 2.1.5 User Growth

Renzo's daily depositors day-over-day growth percentage is shown in the chart below.

source: [Dune](https://dune.com/queries/3334141/5585670)

## 2.2 Competitive Analysis Metrics

### 2.2.1 Market Share

Renzo has the second largest TVL for Liquid Restaking Tokens, with an approximate market share of 26% at the time of writing.

Source: [DefiLlama](https://defillama.com/protocols/Liquid%20Restaking) | Date: March 31, 2024

Source: [Dune](https://dune.com/queries/3300698/5669012) | Date: March 31, 2024

Renzo rose from the 4th largest LRT provider by TVL at the start of January, to the 2nd largest today.

Source: [Dune](https://dune.com/queries/3300716/5527360) | Date: April 1, 2024

### 2.2.2 Trading Volume Share in Total LRT Trading Volume

ezETH makes up a significant portion of overall LRT trading volume as of the last month.

|LRT |Provider |1M Average Volume |
|-------- |-------- |-------- |
|ezETH |Renzo protocol | $49,169,881 |
|weETH |EtherFi | $30,681,106 |
|eETH |EtherFi | $364,562 |
|rswETH |Swell protocol | $1,710,255 |
|rsETH |Kelp DAO | $5,231,328 |
|pufETH |Puffer Finance | $1,419,076 |

### 2.2.3 Protocol Staking Yield

Renzo advertises a 14-day moving average staking yield of 1.95% APR for ezETH holders on its [dApp](https://app.renzoprotocol.com/restake) as of April 17, 2024. By comparison, the Compass Staking Yield Reference Index Ethereum (STYETH Index), which measures the annualized daily staking yield obtained when staking on the Ethereum blockchain, expresses 3.288% at the same time.

### 2.2.4 Slashing Rate

As of the current date, Validators that underpin the value of ezETH, Figment, P2P.org, Luganodes, HashKey Cloud, and Pier Two, have not experienced any slashing incidents, according to [rated.network](https://www.rated.network/).

## 2.3 Subsidization of Economic Activity

### 2.3.1 Existence of an Incentive Program

Renzo actively engages in incentivizing participation within its ecosystem through various means:

- **EigenLayer Loyalty Points:** Renzo commits to passing on 100% of the EigenLayer loyalty points accrued by stakers. Thus, participants shall directly benefit from their contributions to the network's security and growth.
- **Loyalty Point System:** Beyond EigenLayer points, Renzo has developed its own loyalty point system. Despite neither type of loyalty point currently holding economic value, they represent a potential future benefit for participants.
- **Referral System:** Users can earn extra Renzo points by inviting other users who deposit ETH. The system is cumulative, meaning the more people one invites and who actively use or deposit ETH on Renzo, the greater the number of Renzo Points the referrer can earn.
- **Incentive Alignment:** Renzo is aligned both with LSD protocols, by staking their tokens in EigenLayer without selling them for native ETH, and supported chains, by keeping TVL on their chains when users are restaking their tokens.

**DeFi Integrations**
Renzo is incentivising DEX liquidity across multiple DeFi protocols by boosting up to 2x the received Renzo Points - LPs receive 2x the value in the pool per hour. The pool will accumulate 2 points per ezETH or WETH per hour held in the pool. This will get redistributed pro-rata to the LPs. For EigenLayer Restaking points, the pool can only accumulate 1 point per hour per ezETH in the pool. This will get redistributed pro-rata to the LPs. A full breakdown of the details can be found in [Renzo's documentation](https://docs.renzoprotocol.com/docs/integrations/defi).

Renzo also partnered with Pendle Finance - a DeFi yield market, to support ezETH. The main rationale was to address unpredictable ezETH yield that consists of 4 potential APY streams:

1. ETH staking
2. Restaking rewards
3. EigenLayer points
4. Renzo points

From the four APR sources above, currently the only active (and least likely to be considered "speculative") stream is ETH staking APR. By splitting ezETH between the principal and yield token, Renzo stakers can realize airdrop profits early and speculators can buy exposure to future events.

By looking at the Pendle token prices of different LRTs, we can see which LRT yield the market thinks is the most valuable.

Source: [Pendle dApp](https://app.pendle.finance/earn/fixed-yield)

Since AVS validation is still disabled on EigenLayer at the time of writing, and all LRTs have a similar staking yield, the differences in the Pendle rates mostly reflect how the market values the points program of each LRT.

# Section 3: Market Risk

This section addresses the ease of liquidation based on historical market conditions. It seeks to clarify (1) the Liquid Staking Basis & Volatility of ezETH, and (2) the liquidity profile of the collateral. Market risk refers to the potential for financial losses resulting from adverse changes in market conditions.

This section is divided into 2 sub-sections:

- 3.1: Volatility Analysis
- 3.2: Liquidity Analysis

## 3.1 Volatility Analysis

### 3.1.1 Liquid Staking Basis (LSB)

Liquid Staking Basis compares the ezETH market price to the fair value of underlying ETH in the system. The fair value is characterized by an increase in the internal ezETH rate oracle over time. The internal exchange rate is queried from the [BalancerRateProvider](https://etherscan.io/address/0x387dbc0fb00b26fb085aa658527d5be98302c84c/) contract and the daily open market price is provided by Coingecko.

The chart below calculates the LSB at each timestep as:

$$LSB = ezEthPrice/(ezEthRate*EthPrice)-1$$

Source: [CoinGecko](https://www.coingecko.com/en/coins/renzo-restaked-eth)

The absolute LSB shows the overall magnitude of the deviation without respect to positive or negative deviations.

Source: [CoinGecko](https://www.coingecko.com/en/coins/renzo-restaked-eth)

The previous LSB charts do not display a mentionable depeg event that occurred on April 23 when the Renzo Protocol team revealed its controversial governance token allocation that disappointed expectations of ezETH holders, resulting in a sharp sell-off event.

Source: [@RenzoProtocol X account](https://twitter.com/RenzoProtocol). Post was deleted.

This led to a state of panic, during which ezETH depegged significantly, as much as 78% on some trading venues:

Source: [@DeFi_Made_Here X account](https://x.com/DeFi_Made_Here/status/1783128010562121874).

Several lending markets were exposed to ezETH, causing liquidations to users and in some cases bad debt. Morpho users faced [substantial losses](https://x.com/DeFi_Made_Here/status/1783128055244022220), with liquidations for 6-7 figures. Gearbox [lost 50% of the ezETH TVL](https://x.com/DeFi_Made_Here/status/1783128084084039709) and paused users' Credit Accounts, accruing bad debt that will be covered by reserves.

Liquidated users are furthermore not eligible for any airdrop since users must hold ezETH until April 26th, as per Renzo's airdrop eligibility [announcement](https://x.com/RenzoProtocol/status/1783277589525594231).

### 3.1.2 LRT Volatility

Over the course of the past several months, the volatility of daily returns has mostly been contained within an expected range for volatile assets, oscillating between -5% and +5% until a severe market event occured on April 23. The behavior over an extended time period is shown below.

Source: [CoinGecko](https://www.coingecko.com/en/coins/renzo-restaked-eth)

| Volatility | Value |
| --- | --- |
| ezETH daily avg volatility | 3.51% |
| ETH daily avg volatility | 3.38% |
| | |
| ezETH annualized volatility | 67.08% |
| ETH annualized volatility | 64.53% |

However, the usual price action was severely disrupted on April 23, 2024, when ezETH sharply depegged before somewhat normalizing, continuing to trade at a discount. Shown below is the ezETH/WETH UniV3 pool price action from the 23rd - 24th.

Source: [CoinGecko Terminal](https://www.geckoterminal.com/eth/pools/0xbe80225f09645f172b079394312220637c440a63)

The Chainlink price feed, which aggregates from all major liquidity venues, also reported the market-wide depeg.

Source: [ezETH/ETH Chainlink Data Feed](https://data.chain.link/feeds/ethereum/mainnet/ezeth-eth) | Date: 4/24/2024

This extreme volatility is likely attributable to no withdrawals from the protocol at this time, requiring users to exit their position through secondary venues. In recent days, there has been a large outflow from Pendle, likely precipitating the abrupt market pressure.

Source: [Nansen](https://app.nansen.ai/token-god-mode?tokenAddress=0xbf5495efe5db9ce00f80364c8b423567e58d2110&chain=ethereum&tab=token-distribution) | Date: 4/24/2024

## 3.2 Liquidity Analysis

### 3.2.1 Supported DEXs and CEXs

ezETH is included in a number of DEX pools with the highest concentration on Balancer, and it is not listed on any CEXs. The presence of ezETH across various decentralized exchanges highlights its integration and liquidity within the DeFi ecosystem (data taken on April 2, 2024):

| Liquidity Pool | Volume | Price Impact For $10K Swap | Utilization | Liquidity Pool TVL |
| ----------------------------------------------------------------------------------------------------------------------------------------- | --- | --- | --- | ------------------ |
| [Balancer ezETH/WETH](https://app.balancer.fi/#/ethereum/pool/0x596192bb6e41802428ac943d2f1476c1af25cc0e000000000000000000000659) | $111,460,109 | 0.01% | 159% | $70,598,022 |
| [Balancer ezETH/wstETH (ARB)](https://app.balancer.fi/#/arbitrum/pool/0xb61371ab661b1acec81c699854d2f911070c059e000000000000000000000516) | $2,484,810 | 0.01% | 172% | $1,448,986 |
| [Balancer ezETH/weETH/rswETH](https://app.balancer.fi/#/ethereum/pool/0x848a5564158d84b8a8fb68ab5d004fae11619a5400000000000000000000066a) | $16,119,887 | 0.01% | 54% | $394,952,472 |
| [Curve ezETH/WETH](https://curve.fi/#/ethereum/pools/factory-stable-ng-79/deposit) | $3,230,000 | 0.0063% | 96% | $3,354,426 |
| [UniswapV3 ezETH/WETH](https://info.uniswap.org/#/tokens/0xbf5495efe5db9ce00f80364c8b423567e58d2110) | $9,860,000 | 0.018% | 1026% | $980,250 |
| Total | $143,154,806 | - | - | $471,334,156 |

Notably, a significant amount of liquidity is in pools paired with other LSD/LRT assets, as opposed to ETH, creating a greater dependence on other LSD/LRT assets to exit ezETH exposure on secondary markets.

### 3.2.2 DEX Volume

The DEX volume for ezETH is captured in the following charts.

Balancer:
Source: [Dune](https://dune.com/maybeYonas/renzo-protocol#3a-balancer-ezeth-eth-pool-add-liquidity) | Date: March 31, 2024

Uniswap:
Source: [Dune](https://dune.com/maybeYonas/renzo-protocol#3b-uniswap-v3-ezeth-eth-03-pool-add-liquidity) | Date: March 31, 2024

Curve:
Source: [Dune](https://dune.com/maybeYonas/renzo-protocol#3c-curve-ezeth-eth-add-liquidity) | Date: March 31, 2024

### 3.2.3 Trading Volume to Market Capitalization Ratio

As given in section [2.2.2](https://hackmd.io/1rys1T1nTaSOzI1P4GuiYQ?view#222-Trading-Volume-Share-in-Total-LSD-Trading-Volume), the 1 month average trading volume for ezETH is $49,169,881. Divided by its average market cap for the same month, $~1.5B, we get a ratio of roughly 3.3%.

Source: [CoinGecko](https://www.coingecko.com/en/coins/renzo-restaked-eth/historical_data)

### 3.2.4 LRT Leverage Ratio

ezETH has been integrated as a collateral option across several lending and stablecoin platforms, illustrating its growing utility within the DeFi ecosystem:

- [Morpho Blue](https://app.morpho.org/) features an isolated ezETH/WETH market with a Loan-to-Value (LTV) ratio set at 86%, managed via the [MetaMorpho aggregator](https://app.morpho.org/vault?vault=0x78Fc2c2eD1A4cDb5402365934aE5648aDAd094d0) under Re7's supervision.
- [PrismaLRT](https://app.prismafinance.com/vaults) offers an ezETH/ULTRA market, that recently was paused following the [Prisma exploit](https://hackmd.io/@PrismaRisk/PostMortem0328) (the protocol has since been unpaused).
- [Silo Finance](https://www.silo.finance/) recently introduced an ezETH/ETH market, marking its fresh expansion into utilizing ezETH as collateral.

**Morpho Blue**
The Liquidation Loan-to-Value (LLTV) ratio for ezETH on Morpho Blue is distinctively set lower than that for wstETH (94.50%), reflecting a cautious stance towards ezETH's volatility and risk profile. Despite this, ezETH's utilization rate is notably high at 89.85%, with borrowers facing a steep interest rate of 35% for leveraging ezETH as collateral.

The Morpho lending pool experienced bad debt in the aftermath of the ezETH depeg on April 23. Note that Morpho is designed with siloed pools, so the bad debt was limited to the affected pool.

**Prisma Finance**
Although operations at Prisma Finance had been temporarily suspended in March, prior data indicated a borrow interest rate of 19.99% against ezETH, with a Minimum Collateral Ratio (MCR) fixed at 130% or ~77% LTV. The utilization of ezETH in minting ULTRA tokens was comparatively modest, especially when juxtaposed with other LRT markets, suggesting a cautious engagement from the lending community.

**Silo Finance**
Silo Finance's recent integration of ezETH does not yet offer extensive data on its utilization. However, the platform’s decision to set a higher liquidation threshold for ezETH at 90% - compared to the 85% for other Liquid Staking Derivatives - implies a greater confidence in ezETH's peg and/or confidence in the platform's ability to prevent bad debt from occurring.

These dynamics across various platforms reveal a complex picture of ezETH’s adoption as collateral, where platforms exhibit a spectrum of risk appetites and policy adjustments to accommodate ezETH's unique risk-reward profile. This evolving landscape necessitates close monitoring and potentially, adaptive strategies to optimize ezETH's utility and performance as a collateral asset.

# Section 4: Technological Risk

This section addresses the persistence of collateral properties from a technological perspective. It aims to convey (1) where technological risk arises that can change the fundamental properties of the collateral (e.g., unresolved audit issues) and (2) do any composability/dependency requirements present potential issues (e.g., is a reliable price feed oracle available?).

This section is divided into three sub-sections:

- 4.1: Smart Contract Risk
- 4.2: Product and Layer Composability
- 4.3: Oracle Pricefeed Availability

## 4.1 Smart Contract Risk

### 4.1.1 Protocol Audits

Renzo's Ethereum mainnet contracts has one public audit:

- [Halborn](https://github.com/HalbornSecurity/PublicReports/blob/master/Solidity%20Smart%20Contract%20Audits/Renzo_Protocol_EVM_Contracts_Smart_Contract_Security_Assessment_Report_Halborn_Final.pdf) (2023-11-29): 14 findings including 2 critical and 1 medium. All findings were resolved.

No public audits are available for the cross-chain system. However, in their recent [Twitter post](https://x.com/RenzoProtocol/status/1793785619912827160), the team mentions that [@HalbornSecurity](https://x.com/HalbornSecurity) has been on retainer, reviewing all contract upgrades, and is finalizing a full re-audit of the protocol. Additionally, the post mentions that [@sigp_io](https://x.com/sigp_io) was hired in April to complete an independent re-audit of the Renzo Protocol. It is still unclear whether the cross-chain system will be included in this report.

There was also a public audit competition was conducted via [@code4rena](https://x.com/code4rena) that ended on May 8, with over 50 Wardens reviewing the code. The cross-chain system was a part of the competition's scope. The audit competition details can be found [here](https://code4rena.com/audits/2024-04-renzo).

### 4.1.2 Concerning Audit Signs

Renzo's core contracts underwent a singular formal audit, which concluded with several issues, and the team reportedly rectified all identified findings. The public-facing code is presented as accessible and straightforward in its complexity, suggesting an initial layer of transparency and diligence. As described in section 4.1.1 (Protocol Audits), in their recent [Twitter post](https://x.com/RenzoProtocol/status/1793785619912827160), the Renzo team mentions that HalbornSecurity has been finalizing a full re-audit of the protocol, and Sigma Prime was hired in April to complete an independent audit of the Renzo Protocol. It is still unclear whether the cross-chain system will be included in HalbornSecurity's re-audit or in Sigma Prime's independent audit. The Twitter post also mentions that a public audit competition was conducted recently, with the cross-chain system in the competition's scope.

However, a glaring oversight in the singular public formal audit of HalbornSecurity is its omission of critical centralization vulnerabilities, notably the permissions allowing for arbitrary recipient specification during [withdrawals from operators](https://github.com/Renzo-Protocol/contracts-public/blob/master/contracts/Delegation/OperatorDelegator.sol#L211), the [restaking of ETH accumulated in the DepositQueue](https://github.com/Renzo-Protocol/contracts-public/blob/master/contracts/Deposits/DepositQueue.sol#L140), or the unchecked minting of ezETH (see section 5.1.2 Access Controls for a PoC of ezETH infinite mint via the owner multisig). These mechanisms could, in effect, empower the Renzo team — or worse, an adversary who gains control over the multisig wallet — with the capacity to misappropriate user funds.

The audit's Slither analysis revealed more findings than typically deemed acceptable, encompassing issues of high and medium severity. These were summarily dismissed as non-consequential or false positives by the auditing team. Notably, an `approve` call in the `DepositQueue`'s [sweepERC20](https://github.com/Renzo-Protocol/contracts-public/blob/master/contracts/Deposits/DepositQueue.sol#L210) function, which facilitates the transfer of any accumulated ERC20 tokens to the `RestakeManager`, was flagged for not checking return values. This oversight could obstruct the claimability of ERC20 reward tokens by Renzo, particularly with tokens like USDT that do not implement a return call in their `approve()` function. A solution, such as employing [OpenZeppelin's forceApprove function](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/utils/SafeERC20.sol#L76), could preempt such predicaments.

A conspicuous absence of a public formal audit for the cross-chain system further compound these concerns, leaving significant aspects of Renzo's security posture unvetted - at least within the public domain (Note that the Code4rena audit competition did include the cross-chain system, although these findings are not yet public).

### 4.1.3 Bug Bounty

The Renzo Protocol is running a bug bounty with Immunefi, since December the 14th 2023, with a maximum bounty of $250,000. There is a notable omission of the cross-chain system from inclusion in the bounty program. More details can be found at [Immunefi](https://immunefi.com/bounty/renzoprotocol/).

### 4.1.4 Immutability

The majority of Renzo's smart contracts possess pausability and upgradeability features, managed by a [ProxyAdmin contract](https://etherscan.io/address/0x91625601e2BbBEb7171C40c79FadBCFbFf6A1982) that is owned by a [timelock contract](https://etherscan.io/address/0x81F6e9914136Da1A1d3b1eFd14F7E0761c3d4cc7). Transactions can be proposed to the timelock contract by the addresses that are whitelisted under the [PROPOSER_ROLE](https://etherscan.io/address/0x81F6e9914136Da1A1d3b1eFd14F7E0761c3d4cc7#readContract#F4), and executed by addresses that are whitelisted under the [EXECUTOR_ROLE](https://etherscan.io/address/0x81F6e9914136Da1A1d3b1eFd14F7E0761c3d4cc7#readContract#F3).

Currently, two addresses are whitelisted for proposing transactions - `0xAdef586efB3287Da4d7d1cbe15F12E0Be69e0DF0`, an EOA, and `0xD1e6626310fD54Eceb5b9a51dA2eC329D6D4B68A`, a 3/5 multisig. The 3/5 multisig is also whitelisted for executing transactions. The 3/5 multisig also has the TIMELOCK_ADMIN_ROLE, which has the ability to add or remove addresses from the aforementioned whitelists.


The presence of the [OpenZeppelin](https://www.openzeppelin.com/contracts) `TimeLockController` contract, with a 3 day time lock, is set to protect all protocol upgrades, and give users a chance to exit the system in case of an upgrade they do not like. It is worth noting that since withdrawals are still not enabled, users may be required to exit the system at a loss.

Upgradeability is facilitated through the [Transparent Upgradeable Proxy pattern](https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/proxy/transparent/TransparentUpgradeableProxy.sol), noted to be less gas efficient relative to the UUPS proxy pattern, but more commonly used. Unlike the UUPS proxy pattern, where upgrade logic is housed in the implementation contracts, the transparent pattern integrates this logic within the proxy contracts, and checks if the caller is the owner on every call, which increases gas usage.


A list of deployed contracts is accessible here: [Deployed Contracts](https://docs.renzoprotocol.com/docs/contracts/ethereum-mainnet).

### 4.1.5 Developer Activity

In December 2023, Renzo made some of its smart contracts publicly available, not providing any deployment instructions within its public repository, nor sharing its test suite. Since this repository is merely a superficial clone of the private repository, detailed developer activity remains undisclosed. The claim of open-sourcing its smart contracts is subject to scrutiny as external contributions are not facilitated. The transparency regarding the deployed code's alignment with the provided repository remains ambiguous, inviting users to verify code deployment independently through bytecode comparison on the blockchain.

### 4.1.6 SC Maturity

Renzo deployed its smart contracts on December 5, 2023. Despite this significant step, the project has yet to embrace a formal versioning protocol for its smart contracts publicly, leading to challenges in distinguishing between the various iterations and updates of its codebase over time. While it's conceivable that Renzo adheres to versioning practices internally, the external visibility into the protocol's codebase evolution and documentation revisions is significantly hampered due to restricted repository access. This opacity is compounded by the absence of publicly available test suites or deployment guidelines.

The protocol's audit history, comprising solely one private audit and devoid of public audit contests, leaves a gap in the visible trajectory of enhancements or rectifications made in response to audit findings. This scenario underscores a crucial aspect of smart contract development and maintenance that Renzo could further optimize to underscore its commitment to security and reliability.

### 4.1.7 Previous Incidents

To date, there have been no publicly reported incidents associated with Renzo smart contracts.

## 4.2 Product and Layer Composability

### 4.2.1 Dependencies

**EigenLayer Integration**

ezETH distinguishes itself as a Liquid Restaking Token (LRT) through integration with EigenLayer. This platform extends Ethereum's decentralized security infrastructure to additional applications such as Data Availability (DA) layers, oracle networks, and sidechains, offering validators enhanced yield in exchange for assuming greater responsibilities and risks. The collaboration between Renzo and EigenLayer's contracts enables this restaking functionality. However, two primary risks are associated with EigenLayer: the potential for crypto-economic security breaches if the cost of corruption is lower than the profit from corruption and the possibility of wrongful slashing due to inaccurately defined slashing conditions or unexpected behavior of node operators. EigenLayer addresses these concerns by developing automated monitoring systems and establishing a security council to oversee slashing decisions.

**Connext & CCIP Integration**

In collaboration with Connext Network and Chainlink's Cross-Chain Interoperability Protocol (CCIP), Renzo Protocol is bringing native cross-chain restaking to supported layer 2 and alternative L1 networks. ETH holders can restake from those networks without migrating funds back to the L1, aligning incentives between Renzo and the supported networks, and enhancing user experience.

Connext is a modular interoperability protocol for passing funds and data between chains. Developers can use Connext to build cross-chain apps that interact with multiple blockchains or rollups simultaneously.

Since the xezETH that is minted on the non-Ethereum chains are not redeemable, and ezETH will be minted only following admin action, limited risks are introduced to the core L1 system. However, xezETH minters are potentially vulnerable to slippage caused by the reported ezETH price, which is provided by the [RateProvider](https://etherscan.io/address/0x387dBc0fB00b26fb085aa658527D5BE98302c84C) and transmitted using CCIP, and various bridge-related inflation attackes which can lead to significant value lost of those xezETH holding on the respective chain. Moreover, a quick look at the `xRenzoDeposit` implementation contract, shows that not only CCIP can update the ezETH price, but also the contract's owner, using the [updatePriceByOwner](https://arbiscan.io/address/0x8e70efc8f2a7b08193ec4e5295849c97f2a84a73#writeContract) function.

**Price Oracles**

When deposits are made into the Renzo protocol, price oracles are used to determine the ETH-denominated value of the TVL and the deposited asset. A malfunctioning price oracle might cause a disproportionate minting of ezETH, unjustly inflating it's supply.

As of today, the only LSDs supported by the protocol are [Wrapped Binance Beacon ETH (wBETH)](https://etherscan.io/address/0xa2E3356610840701BDf5611a53974510Ae27E2e1) and [Lido's stETH](https://etherscan.io/token/0xae7ab96520de3a18e5e111b5eaab095312d7fe84). The price for wBETH is fetched using [this contract](https://etherscan.io/address/0xd38fff8cf7365feddd54384414b59ac328e2346a#code), titled `WBETHShim`, from a price oracle operated by Binance, which is [completely centralized](https://etherscan.io/address/0x81720695e43A39C52557Ce6386feB3FAAC215f06). The `WBETHShim` contract does not check for the liveness of the Binance oracle, nor for any anomalies in its reported price, but blindly trusts it. On-chain analysis indicates regular updates of the Binance oracle's exchange rate, which occur every 24 hours or so.

*Note that the price of stETH is obtained directly from a [Chainlink oracle](https://etherscan.io/address/0x86392dc19c0b719886221c78ab11eb8cf5c52812), again, without checking for liveness or price anomalies. We focus attention on the Binance oracle, as it presents a more palpable centralization vector.*

We have tested the potential for manipulability of the ezETH supply in case the Binance price oracle misreports the wBETH price in a forked mainnet. ezETH can theoretically be inflated up to the [wBETH TVL limit](https://etherscan.io/address/0x74a09653A083691711cF8215a6ab074BB4e99ef5#readProxyContract#F4) imposed by the protocol (currently set to 50k wBETH). With a 13.6k wBETH TVL as of April 25, 2024, up to 36.4k ETH worth of ezETH can potentially be erroneously minted.

See below that the Binance oracle report can be inflated and that a lack of sanity checks in the Renzo contract allows 3x the amount of ezETH to be minted from wBETH when the oracle is manipulated. The manipulation is possible up to the `collateralTokenTvlLimit` previously described.



<!--
**TODO** - add Redstone oracle (https://app.redstone.finance/#/app/token/ezETH\ETH)
-->

### 4.2.2 Withdrawals Processing

While [Renzo's documentation allocates a section to the process of withdrawals](https://docs.renzoprotocol.com/docs/renzo/ezeth#withdrawals), it's crucial to underscore that, as of the current moment, the functionality for ezETH withdrawals remains conspicuously inactive. This limitation is not merely an oversight but a significant functional gap in the deployed implementation contracts. The protocol's stance, as delineated in its documentation, suggests an alternative route for users looking to exit their ezETH positions - namely, by engaging in liquidity provision or selling their ezETH on Balancer.

This guidance, while providing a temporary workaround, raises substantial concerns regarding the liquidity and market stability of ezETH, especially under conditions of heightened market volatility or in scenarios where Balancer’s liquidity might not suffice to accommodate large or numerous withdrawal intents. The absence of a direct withdrawal mechanism fundamentally restricts arbitragers in fixing its market price, and potentially placing users at a disadvantage by compelling them to navigate secondary markets or liquidity pools, which may not always offer favorable conditions or prices.

## 4.3 Oracles Pricefeed Availability

### 4.3.1 Understanding the Oracle

ezETH has a robust [Chainlink oracle](https://data.chain.link/feeds/ethereum/mainnet/ezeth-eth), that is available on Ethereum, Arbitrum, and Linea networks. A new answer is written when the offchain data moves more than the 0.5% deviation threshold or 24 hours have passed since the last answer was written on-chain. The smart contract is connected to 16 oracles, while each price aggregation requires an answer from at least 11 of them.

Chainlink uses a "Volume Weighted Average Price" (VWAP) price aggregation methodology. VWAP is a mechanism used to calculate the price of an asset by taking price data from multiple trading environments and weighting each price by the amount of volume on each liquid market an asset is trading on. More information about the advantages of the VWAP mechanism can be found in [Chainlink's documentation](https://chain.link/education-hub/twap-vs-vwap).

### 4.3.2 Token Liquidity and Distribution

**Total Token Distribution**
As of April 2, 2024, analysis of ezETH's total supply distribution highlights that the top five holders account for nearly 80% of the tokens. It's important to contextualize this figure, especially considering that a significant portion of ezETH is engaged in DeFi platforms like Pendle, Zircuit, and within Balancer pools, which could represent a multitude of individual user holdings rather than a few centralized entities.

Over 30% of ezETH is allocated within Pendle, indicating widespread user participation rather than centralized control. Similarly, more than 20% is engaged on [Zircuit](https://www.zircuit.com/), a Layer 2 solution facilitating LRT staking, potentially aggregating numerous individual stakes. Furthermore, Balancer pools, holding nearly 3% of ezETH's supply, also serve as a collective investment medium for a broad user base.

Source: [Etherscan](https://etherscan.io/token/0xbf5495efe5db9ce00f80364c8b423567e58d2110#balances) | Date: 4/2/2024

The `0xC81...059` address, identified as Renzo's [Lockbox contract](https://etherscan.io/address/0xC8140dA31E6bCa19b287cC35531c2212763C2059), indicates that close to 20% of the total supply is utilized across non-Ethereum-mainnet networks, illustrating ezETH's cross-chain functionality. The presence of a [giant whale](https://debank.com/profile/0x22162dbba43fe0477cdc5234e248264ec7c6ea7c) (`0x221...a7c`) does raise questions about individual large-scale holdings.

**Liquidity Venue Distribution**
Taking a look only at liquidity pools, the vast majority of ezETH is concentrated in Balancer pools, followed by a small portion in Uniswap and Curve.

Source: [Nansen](https://app.nansen.ai/token-god-mode?tokenAddress=0xbf5495efe5db9ce00f80364c8b423567e58d2110&chain=ethereum&tab=exchanges) | Date: 4/25/2024

**Cross-Chain**
An on-chain analysis of the ~20% of ezETH situated on non-Ethereum-mainnet networks shows a diversified presence across Arbitrum, Blast, Mode network, Linea, and BSC, further underscoring the token's broad adoption. Within Arbitrum, despite the concentration among the top three holders, the largest portion is held by Pendle, potentially pointing to DeFi participation rather than necessarily centralized hoarding. BlackWing Finance and a bridge by Matter Labs follow, contributing to the ecosystem's liquidity and accessibility.

Source: [Arbiscan](https://arbiscan.io/token/0x2416092f143378750bb29b79ed961ab195cceea5#balances)

<!--
On Blast - **TODO** - Marin

(source: [BlastExplorer](https://blastexplorer.io/token/0x2416092f143378750bb29b79eD961ab195CcEea5/balances))

On Mode - **TODO** - Marin
-->
This nuanced view of ezETH's distribution paints a picture of a token with substantial engagement in DeFi platforms. It underscores the importance of distinguishing between tokens held in DeFi protocols, which can represent pooled investments from numerous users, and those held by individual addresses, which might indicate more centralized control.

<!--
| Balance | Addresses | % Addresses (Total) | Amount (EZETH) | Amount (USD) | % Coins (Total) |
| --- | --- | --- | --- | --- | --- |
| 0 - 0.01 EZETH | 9.45k | 34.29% | 10.7 EZETH | $34.53k | 0.00% |
| 0.01 - 0.1 EZETH | 3.47k | 12.59% | 181.32 EZETH | $585.43k | 0.02% |
| 0.1 - 1 EZETH | 10.95k | 39.73% | 3.29k EZETH | $10.62m | 0.32% |
| 1 - 10 EZETH | 2.81k | 10.19% | 8.17k EZETH | $26.38m | 0.80% |
| 10 - 100 EZETH | 656 | 2.38% | 23.87k EZETH | $77.08m | 2.33% |
| 100 - 1k EZETH | 199 | 0.72% | 57.85k EZETH | $186.79m | 5.64% |
| 1k - 10k EZETH | 20 | 0.07% | 70.84k EZETH | $228.74m | 6.90% |
| 10k - 100k EZETH | 3 | 0.01% | 43.67k EZETH | $141.01m | 4.25% |
| 100k - 1m EZETH | 3 | 0.01% | 818.65k EZETH | $2.64b | 79.75% |
| > 1m EZETH | 0 | 0.00% | 0 EZETH | $0.00 | 0.00% |

(source: [IntoTheBlock](https://app.intotheblock.com/coin/EZETH/deep-dive?group=ownership&chart=holdingsDistribution))
-->

# Section 5: Counterparty Risk

This section addresses the persistence of ezETH's properties from an ownership rights perspective (i.e., possession, use, transfer, exclusion, profiteering, control, legal claim). The reader should get a clear idea of (1) who can legitimately change properties of the collateral (e.g., minting additional units) and what their reputation is, (2) the extent to which changes can be implemented, and the effect on the collateral.

This section is divided into four subsections:

- 5.1: Governance
- 5.2: Decentralization of the LSD
- 5.3: Legal

## 5.1 Governance

### 5.1.1 Governance Scope

As of the current phase, Renzo operates without a Decentralized Autonomous Organization (DAO), with governance centralized within the Renzo team. According to the Renzo documentation, a transition towards DAO governance is planned, although any specific details remain unspecified.

### 5.1.2 Access Control

The access control mechanisms of Renzo's smart contracts pivot around the [RoleManager](https://etherscan.io/address/0x4994EFc62101A9e3F885d872514c2dC7b3235849) contract, with its source code available [here](https://github.com/Renzo-Protocol/contracts-public/blob/master/contracts/Permissions/RoleManager.sol). This contract involves a role-based access control scheme that divides privileged roles, and has a DEFAULT_ADMIN_ROLE responsible for assigning all other roles in the system, currently assigned to the [3/5 Renzo multisig wallet](https://etherscan.io/address/0xD1e6626310fD54Eceb5b9a51dA2eC329D6D4B68A).

See below the various roles and their address assignments, current as of 5/24/2024. Certain roles, such as the RX_ETH_MINTER_BURNER, are assigned to a contract to limit risk of malicious minting. Other roles, such as the DEPOSIT_WITHDRAW_PAUSER, have EOAs assigned that may increase the efficieny in responding to emergencies. Note however, that extensive power is granted to the Renzo 3/5 multisig through its ability to assign all other roles.


We have further produced a PoC that demonstrates a potential attack vector whereby the DEFAULT_ADMIN_ROLE assigns the RX_ETH_MINTER_BURNER to a malicious address, and infinite mints ezETH. This demonstrates the critical trust assumption in the Renzo 3/5 multisig for overall system stability.


The requirement for merely three out of five signatures to greenlight new deployments or modifications introduces a relatively lenient security posture. This threshold, considerably lower than what might be observed in more conservatively designed systems, introduces palpable risks concerning the security and integrity of governance actions. Moreover, the lack of a timelock mechanism compounds these risks, permitting the enactment of changes with immediate effect, bypassing the opportunity for community scrutiny or preventive review.

This governance structure, while facilitating agility in decision-making, potentially compromises the protocol's resilience against unauthorized or hasty modifications. Enhancing the governance framework with more stringent control mechanisms, such as on-chain voting or the incorporation of a timelock to allow for discontent participants to exit, could significantly reinforce the protocol's governance structure and stakeholder confidence.

The current signers of the Renzo multisig are:

- [0xC66476C083812eF4AF9567EC4B0b737230b5754d](https://etherscan.io/address/0xC66476C083812eF4AF9567EC4B0b737230b5754d)
- [0x9D359DA6cA68ddBfB148d07b74Aa3aFD1F65039F](https://etherscan.io/address/0x9D359DA6cA68ddBfB148d07b74Aa3aFD1F65039F)
- [0xA724796812276dDDF1dC65dF91E11c1933A72371](https://etherscan.io/address/0xA724796812276dDDF1dC65dF91E11c1933A72371)
- [0xfAFf23C643c89f6C8F2AbE3D08e207591Af93d1c](https://etherscan.io/address/0xfAFf23C643c89f6C8F2AbE3D08e207591Af93d1c)
- [0x565E8E4771C0Ef8a64C8C7de224816eC1121E671](https://etherscan.io/address/0x565E8E4771C0Ef8a64C8C7de224816eC1121E671)

The identity of the signers is not publicly known.

### 5.1.3 Distribution of Governance

Renzo still needs to introduce a governance token. Details about the distribution process are yet to be disclosed, though it is anticipated that Renzo points might play a significant role in this event.

### 5.1.4 Proposals Frequency

Without governance tokens, there is no formal mechanism for community proposals or voting within the Renzo ecosystem. However, users can engage with the Renzo team and discuss matters on their [Discord server](https://discord.gg/renzo), facilitating some level of community interaction.

### 5.1.5 Participation

A critical consideration for LRTs like those offered by Renzo involves the selection process for EigenLayer's AVSs, each with distinct risk and reward profiles. The Renzo team has expressed interest in conducting that process using its governance. The documentation states that initially this process will be done via snapshot votes, and after processes are defined, tested, and proven, it will move to full on-chain governance.

## 5.2 Decentralization of the LRT

Renzo's strategy for achieving decentralization within its Liquid Restaking Token (LRT) framework draws parallels to Lido's methodology, initially engaging exclusively with professional node operators. This decision is primarily aimed at reducing operational complexities early on, with a view to addressing broader network distribution challenges subsequently. However, the absence of publicly disclosed plans or strategies for enhancing network distribution poses a notable concern.

This approach, while pragmatic in its initial phase, raises questions regarding the long-term commitment to decentralization. The lack of transparency and detailed roadmap for expanding node operator diversity and distribution leaves stakeholders in the dark about Renzo's strategies for evolving beyond its current centralized operational model.

The importance of clear, actionable plans for achieving widespread network distribution cannot be overstated. Stakeholders would benefit from insight into Renzo's future steps towards decentralization, ensuring the protocol's alignment with the community's expectations for a truly decentralized and resilient LRT ecosystem.

### 5.2.1 Number of Node Operators

Renzo collaborates with 5 permissioned professional node operators, [Figment](https://figment.io/), [p2p.org](https://p2p.org/), [Luganodes](https://www.luganodes.com/), [HashKey](https://www.hashkey.cloud/), and [Pier Two](https://piertwo.com/)

### 5.2.2 Validators per Node Operator

Renzo protocol has 28,102 active Validators and 5 Node Operator Delegators, so in average 5,620.4 Validators per Node Operator. NOs addresses are listed below:

**Operator delegators ([EigenPod manager](https://etherscan.io/address/0x91E677b07F7AF907ec9a428aafA9fc14a0d3A338))**

1. [OperatorDelegator1](https://etherscan.io/address/0x78524bEeAc12368e600457478738c233f436e9f6) | [EigenPod1](https://etherscan.io/address/0x35Cb1491dCf4C0AB6b413AfC42298e32f13FF524)
2. [OperatorDelegator2](https://etherscan.io/address/0x125B367C16C5858f11e12948404F7a1371a0FDa3) | [EigenPod2](https://etherscan.io/address/0xd4018Ce9A041a9c110A9d0383d2b5E1c66Ae1513)
3. [OperatorDelegator3](https://etherscan.io/address/0x0B1981a9Fcc24A445dE15141390d3E46DA0e425c) | [EigenPod3](https://etherscan.io/address/0x093f6C270aC22EC240f0C6fd7414Ea774ca8d3e5)
4. [OperatorDelegator4](https://etherscan.io/address/0xbaf5f3a05bd7af6f3a0bba207803bf77e2657c8f) | [EigenPod4](https://etherscan.io/address/0x2641C2ded63a0C640629F5eDF1189e0f53C06561)
5. [OperatorDelegator5](https://etherscan.io/address/0x38cDB1A8207264C1A07c42c43A4c3ED4bfab7CEA) | [EigenPod5](https://etherscan.io/address/0xDD0212d0da33a2235d1952dA390a0A18EAcc7af5)

### 5.2.3 Validator Enter/Exit (Churn)

Withdrawals are not activated for ezETH.

### 5.2.4 Distribution Across Geographical Locations
This data isn't provided for Renzo protocol.

### 5.2.5 Node Software Diversity
This data isn't provided for Renzo protocol.

## 5.3 Legal

### 5.3.1 Legal Structure

The website renzoprotocol.com by RestakeX Ventures Ltd serves as a conduit to Renzo Protocol. It is maintened by a collective of ecosystem participants alongside entities such as the RestakeX Foundation.

In terms of corporate transparency, RestakeX Ventures Ltd, shrouds itself in a veil of confidentiality. An exhaustive search has yet to illuminate the particulars of its incorporation. It might be a private company, and details on private companies are usually not publicly available.

On the other hand, [Terms of Service](https://docs.renzoprotocol.com/docs/legal/terms-of-service) points unequivocally to the British Virgin Islands (BVI):
>*These Terms and any action related thereto will be governed by the British Virgin Islands Arbitration Law and the laws of the British Virgin Islands, without regard to its conflict of laws provisions*.

This subtly indicates that RestakeX Ventures Ltd might indeed be incorporated within the BVI’s shores.

However, RestakeX Foundation presents an enigma concerning its jurisdictional roots. Its establishment could very well parallel RestakeX Ventures Ltd, nestling within the BVI's legal framework. Alternatively, it may find its legal underpinnings in a disparate jurisdiction—a question that remains open in the absence of conclusive findings from open-source inquiries.

### 5.3.2 Licenses

Staking remains unregulated in the BVI. Consequently, the concept of restaking—redeploying staked ETH to secure additional services— also should not fall under the purview of existing BVI statutes.

For BVI-based entities that handle tokens and manage staking pools, including the distribution of rewards, compliance with the Virtual Asset Service Providers Act (VASP Act) may be obligatory. Under the VASP Act, a "virtual asset" is identified as any digital representation of value that can be digitally traded, transferred, and utilized either for payment or investment purposes. It notably excludes digital representations of fiat currencies. Entities providing services such as exchanges between virtual assets and fiat currencies, exchanges among different virtual assets, transfers, custodianship, or management of virtual assets—or those offering financial services linked to virtual assets—must register as Virtual Asset Service Providers (VASPs).

A notable exception purportedly used by RestakeX Ventures Ltd is the one for “*the development, sale or offering of software or hardware”*. The company is in charge of developing an open-source software portal, www.renzoprotocol.com, which is the entry point to the DeFi protocol. RestakeX Ventures Ltd makes no assertions regarding the custody of virtual assets, management of the staked tokens or rewards distribution; these functions are autonomously performed by smart contracts. Due to limited available data on the protocol’s legal structure, a comprehensive legal analysis remains constrained. However, the existing description of the system architecture suggests that the company operating the front-end interface does not directly engage in handling virtual assets on behalf of its clients.

Turning to securities regulation, the BVI’s primary legislative framework is encapsulated in the Securities Investment Business Act, 2010 (SIBA). SIBA regulates licensing and oversees entities involved in investment activities within or from the BVI, delineating an exhaustive list of instruments categorized as “investments.” Although crypto tokens are not explicitly listed, the classification of a token as an investment hinges on a detailed analysis of its characteristics and functionalities. If a token is deemed an investment, the issuer may be subject to regulations concerning the dealing in or arranging of securities. This, however, could also depend on whether the issuer’s activities qualify for any exclusions or safe harbors outlined in SIBA.

To date, there has been no indication that ezETH is classified as a security under SIBA, suggesting that it does not meet the specific criteria that would necessitate such classification.

### 5.3.3 Enforcement Actions

Renzo Protocol has, thus far, appeared to navigate the complex regulatory waters without falling foul of enforcement actions. This observation stems from a comprehensive search which, notably, did not yield any records of regulatory scrutiny, litigation, or sanctions directed against the protocol by regulators, national agencies, or other authoritative bodies.

### 5.3.4 Sanctions

Specific details on sanctions screening are not explicitly mentioned in Renzo documentation.

RestakeX Ventures Ltd stipulates specific conditions regarding the permissible use of its services, particularly emphasizing restrictions for U.S. persons and residents of other unspecified jurisdictions. The explicit prohibition for U.S. persons is detailed in the Notice on Prohibited Use, but the text lacks a comprehensive delineation of other international restrictions, only suggesting a broader, yet undefined, set of limitations.

> NOTICE ON PROHIBITED USE – US AND OTHER RESTRICTED PERSONS: THE SERVICES ARE NOT OFFERED TO AND MAY NOT BE USED BY: PERSONS OR ENTITIES WHO RESIDE IN, ARE CITIZENS OF, ARE LOCATED IN, ARE INCORPORATED IN, OR HAVE A REGISTERED OFFICE IN THE UNITED STATES OF AMERICA (COLLECTIVELY, “US PERSONS”) OR PERSONS OR ENTITIES WHO RESIDE IN, ARE CITIZENS OF, ARE LOCATED IN, ARE INCORPORATED IN, OR HAVE A REGISTERED OFFICE IN ANY RESTRICTED TERRITORY, AS DEFINED BELOW (EACH SUCH PERSON OR ENTITY FROM A RESTRICTED TERRITORY, A “RESTRICTED PERSON”).
> [Terms of Service](https://https://docs.renzoprotocol.com/docs/legal/terms-of-service)

The Services, that per our interpretation, consist of providing interface for access to Renzo Protocol are confined to users residing in countries where such interactions do not contravene applicable laws. The Services are explicitly unavailable in specific jurisdictions, notably the United States. The exclusion of U.S. users is made clear, yet the protocol stops short of listing other affected jurisdictions, which may lead to ambiguities for potential users.

In a move to enforce these geographical and regulatory boundaries, RestakeX Ventures Ltd reserves the unilateral right to obstruct access to the services at any point. This is enforceable by blocking IP addresses and device identifiers that attempt to access the services from restricted regions.

### 5.3.5 Liability Risk

The Services rendered by RestakeX Ventures Ltd provide information solely for informational purposes and should not be regarded as professional advice. The Terms of Use explicitly state that no fiduciary duties are owed by the Company to the users.

Renzo refrains from offering assurances or guarantees regarding both the underlying protocol and the user interface. There are no promises for profitability from staking or restaking of crypto assets. Renzo emphasizes in a stand-alone [Disclaimer](https://docs.renzoprotocol.com/docs/legal/disclaimer) that all interactions with its services, including potential financial outcomes, are conducted solely at the user's own risk.

ezPoints, projected as a reward mechanism to incentivize users, are designed to accrue to the user's ezETH balance, with specific conditions outlined to prevent abusive practices such as "looping." Looping is described as the act of using the same ezETH repeatedly to generate additional rewards by converting ezETH back to ETH to restart the reward process. Such actions are explicitly prohibited, and Renzo has implemented monitoring systems to detect and penalize this behavior by disqualifying offending users from receiving ezPoints and any associated boosts.

However, the points program is not incorporated into the ToS. This means there is no formal documentation detailing the terms, definitions, or the rights and obligations associated with Renzo points. The lack of formal integration into the ToS could lead to legal and operational ambiguities, particularly in scenarios where disputes arise over the allocation or deduction of points, or when users are sanctioned for prohibited activities such as looping.

RestakeX Ventures Ltd is not required to actively monitor the use of its Services or the content posted by users, which suggests an initial hands-off approach favoring user autonomy, while keeping the discretionary right to monitor content and restrict access to ensure operational effectiveness and compliance with legal obligations.

The Services are provided "as is" with no warranties of any kind. Neither the Company, nor its service providers will be liable for indirect damages such as lost profits, revenue, savings, business opportunities, data, goodwill, or the costs of substitute services arising from the use or inability to use the Services. The total liability for all claims related to the Services is capped at the greater of the amount paid by the user for the Services or one hundred dollars ($100), provided that the user has not incurred any payment obligations.

Disputes arising from ToS or the Services are to be resolved exclusively through binding, individual arbitration, not in a class or representative basis. The Cayman Islands Arbitration Law will apply, indicating a choice for a neutral arbitration locale separate from the governing law of the website Terms. Arbitration will be administered by JAMS under its rules, which are designed to provide a comprehensive framework for resolving disputes efficiently. Parties must bring claims individually, not as part of any class or collective action, with arbitration not to consolidate multiple claims. This significantly reduces the risk of widespread litigation liabilities for RestakeX Ventures Ltd but limits the recourse options for individuals.

### 5.3.6 Adverse Media Check

The diligent exploration into Renzo Protocol, RestakeX Foundation, and RestakeX Ventures Ltd has culminated without unearthing any direct associations with adverse media. This scrutiny sought traces of money laundering, corruption, sanctions exposure, threat financing, or other illicit undertakings but found no concrete links to these entities.

Moreover, our inquiry extended into the realms of fraud, scam, phishing, impersonation, and akin malevolent activities within the social media landscape surrounding the DeFi sector. Yet, it failed to discern any direct connections implicating Renzo Protocol, RestakeX Foundation, or RestakeX Ventures Ltd in such nefarious activities.

# Section 6: Risk Management
This section will summarize the findings of the report by highlighting the most significant risk factors in each of the three risk categories: Market Risk, Technology Risk, and Counterparty Risk.

### 6.1.1 Market Risk

**LIQUIDITY: Does the LSD have a liquid market that can facilitate liquidations in all foreseeable market events?**

A predominant share of ezETH is currently allocated within Pendle, earmarked for speculation on future yields, leaving a mere approximate 4% of the token supply in decentralized exchange pools. In this context, ezETH may face significant challenges particularly during market stress periods.

Fueled by the anticipation of an EigenLayer airdrop, ezETH's growth harbors the potential to precipitate market instability. External market factors of any kind may adversely impact ezETH's liquidity which is relatively centralized on Pendle venues.

**VOLATILITY: Has the LRT had any significant depeg event?**

ezETH has not enabled withdrawals from the protocol, requiring holders to exit through secondary venues. This restriction dramatically increases the probability of depeg events, as the protocol can not facilitate fluctuations in demand, requiring some amount of speculation about future withdrawal capability to maintain its peg. On April 23rd the resiliency of ezETH's soft peg was tested when it experienced a sharp depeg with a prolonged recovery time. This is likely to be a recurring event so long as withdrawals are not activated, and requires extreme caution when onboarding as collateral.

### 6.1.2 Technology Risk

**SMART CONTRACTS: Does the analysis of the audits and development activity suggest any cause for concern?**

A single publicly available audit was conducted over Renzo’s core contracts, uncovering multiple problems which were reportedly fixed. Critical centralization risks were overlooked, especially related to the control of funds. The audit's leniency with certain severe findings raises concerns about the thoroughness and efficacy of the process. The absence of wider public audit scrutiny particularly in cross-chain operations, even though covered in its public audit contest, highlights significant security exposure.

Smart contract deployment began in December 2023 without a public versioning protocol, obscuring the evolution of its codebase. Public repository activities suggest limited external engagement and transparency, with key documentation and testing protocols absent. There is a bug bounty program with ImmuneFi, which offered a relatively low maximum payout for critical reports compared to the protocol size. Additionally, the bug bounty program does not include the cross-chain system in its scope.

**DEPENDENCIES: Does the analysis of dependencies (e.g., oracles) suggest any cause for concern?**

The integration of Renzo's ezETH with [EigenLayer](https://www.eigenlayer.xyz/) introduces a series of potential risks, particularly around crypto-economic vulnerabilities and the potential for inaccurately defined slashing conditions, despite its allure of augmented Validator yields. Expanding native restaking across various L1/L2 networks via Connext and Chainlink's CCIP introduces no direct incremental risks to Renzo's core system on Mainnet. Nonetheless, there are substantial vulnerabilities for xezETH minters due to potential slippage from the ezETH price reports provided by the RateProvider and transmitted via CCIP. Moreover, ezETH price can be updated not only via CCIP but also by the contract's owner through the `updatePriceByOwner` function.

Renzo's reliance on the centralized oracle for wBETH, is a critical point of vulnerability. The absence of intermediary buffer contracts that could provide checks for operational continuity and anomalous price fluctuations represents a significant oversight. The price of stETH is derived directly from a Chainlink oracle, that notably lacks safeguards against potential liveness or price anomaly checks.

A critical functional deficiency is observed - ezETH withdrawals remain inoperative at present. The outlined alternative involves engaging in liquidity provision or swapping on Balancer, which presents its own set of risks and dependencies.

### 6.1.3 Counterparty Risk

**CENTRALIZATION: Are there any significant centralization vectors that could rug users?**

Renzo’s architecture exhibits pronounced centralization vectors that could potentially compromise user security and protocol integrity. The crux of the issue lies in the trifecta of centralized control aspects: the concentration of Validator operations, significant sway held by the development team, and reliance on a centralized wBETH price oracle. This amalgamation of centralization points forms a precarious foundation, where the protocol could be susceptible to manipulation or even user exploitation without necessitating changes to the existing contract implementations.

While the decentralisation approach mirroring that of Lido seems practical at the outset, the lack of a publicly available strategy raises concerns about the commitment to diversification. A governance token is not yet introduced and details on future distribution mechanisms remain undisclosed.

Renzo’s governance is controlled by a RoleManager contract managed by a 3/5 multisig wallet. The presence of timelock mechanisms alleviates some of the centralization concerns regarding contract upgrades. However, the RoleManager contract, through the 3/5 multisig wallet assigned as the DEFAULT_ADMIN_ROLE, has the capacity to inappropriately misuse users funds, as demonstrated in section 5.1.2 (Access Control).

**LEGAL: Does the legal analysis of the Protocol suggest any cause for concern?**

The legal structure analysis indicates that the front-end operator is presumed to be based in the BVI, where there are no current restrictions on staking or restaking activities. ezETH, on its own, is not classified under securities laws within this jurisdiction.

Any disputes that arise from interactions with Renzo's front-end are designated to be resolved through arbitration proceedings in the Cayman Islands. However, a significant concern arises with the Renzo points program, which currently lacks ToS integration. This omission results in an ambiguous framework regarding the allocation and management of points, particularly in cases of perceived unfair use or miscalculated point allocations.

### 6.1.4 Risk Rating

Based on the risks identified for each category, the following chart summarizes a risk rating for ezETH as collateral. The rating for each category is ranked from excellent, good, ok, and poor.

- We rank ezETH **ok in liquidity** due to high concentrations in DEX pools paired with other LSDs/LRTs, and the possibility of transient popularity driven by speculative interest in EigenLayer points.
- We rank ezETH **poor in volatility** due to the fact that withdrawals are disabled, inhibiting arbitrageurs from maintaining ezETH's peg.
- We rank ezETH **ok in smart contracts** due to a singular public formal audit on its core system, while its cross-chain functionalities having just recently been assessed in a public audit contest. Additionally, the bug bounty program excludes the cross-chain system, and both the code life cycle and the testing suite - if it exists - are not publicly disclosed.
- We rank ezETH **ok in dependencies** due to the centralization of its wBETH oracle and the lack of liveness or price anomalies checks. There is a Chainlink price feed available for ezETH.
- We rank ezETH **poor in decentralization** due to the absence of a clear strategy for decentralizing node operations, despite existing plans for governance and on-chain activity. Furthermore, the system's current structure is significantly centralized around the Renzo team, granting them unilateral control over user funds with the potential for malfeasance.
- We rank ezETH **ok in legal** due to its relatively clear legal structure and operation within jurisdictions that offer favorable conditions for staking services. While Renzo has implemented measures to restrict US users, it falls short in delineating restrictions for users from other countries (incl. these under international sanctions).

<iframe src='https://flo.uri.sh/visualisation/14951150/embed' title='Interactive or visual content' class='flourish-embed-iframe' frameborder='0' scrolling='no' style='width:100%;height:600px;' sandbox='allow-same-origin allow-forms allow-scripts allow-downloads allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation'></iframe><div style='width:100%!;margin-top:4px!important;text-align:right!important;'><a class='flourish-credit' href='https://public.flourish.studio/visualisation/14951150/?utm_source=embed&utm_campaign=visualisation/14951150' target='_top' style='text-decoration:none!important'><img alt='Made with Flourish' src='https://public.flourish.studio/resources/made_with_flourish.svg' style='width:105px!important;height:16px!important;border:none!important;margin:0!important;'> </a></div>

Prisma has already introduced ezETH as collateral for its ULTRA stablecoin. We advise reevaluating the inclusion of ezETH as a collateral asset in light of concerning signs regarding market risk, counterparty risk, and technology risk.

Despite its explosive growth in recent months, users should exercise considerable caution when dealing with ezETH, particularly as a collateral asset. This caution is warranted (as evidenced by its recent depegging event) due to its highly centralized operation, concerning signs in its technical security practices, its reliance on centrally controlled dependencies, and the fact that withdrawals are disabled.

Furthermore, there is currently substantial speculation around Eigenlayer and Renzo points programs. Once the points incentive program concludes or speculation subsides, ezETH may potentially face rapid exit demand that puts further pressure on the peg. Extra caution is recommended at this time.

Our recommendation is to mitigate protocol risk by not permitting ezETH to be used as collateral, at least until withdrawals are enabled, and steps have been taken to reduce the centralized control exerted by the Renzo team over user funds. Preferably there should be limitations on ezETH exposure until speculation around Eigenlayer and liquid restaking subsides. Protocols seeking to onboard ezETH as collateral may consider gaining exposure to ezETH through an isolated money market, setting conservative parameters, and prioritizing extensive user education.