mETH Protocol (Mantle)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED. mETH is deployed on Ethereum L1, permissionless to hold and use, and backed by ETH routed through protocol contracts to Ethereum validators; the Mantle chain rejection does not automatically dispose of it. But the direct comparison now resolves against approval. Four permissioned professional operator groups run the disclosed validator set, operator allocation and client diversity remain insufficiently public, a 6-of-13 Mantle Security Council holds material parameter and emergency roles, and the proxy system is upgradeable through a TimelockController. The protocol charges 10% of staking rewards, the same headline fee as Lido, without Rocket Pool’s permissionless operator set. Since December 2025, the project has described a Buffer Pool upgrade intended to make mETH-to-ETH redemptions more efficient. The surviving primary record does not establish fixed capacity, a contractual completion time, exact asset allocation or stress behavior, so the upgrade receives no decision credit beyond its stated purpose. The structure has a clean disclosed core-loss and slashing record, but offers no verified net-yield advantage over approved peers. Primary project materials do not establish a client-usable advantage over approved Lido or Rocket Pool that compensates for the four-operator set, transitional Mantle/COOK authority and upgrade controls. A buffer may improve convenience, but its live capacity, controls, assets and stressed performance must be verified rather than inferred. Rejection is therefore the present decision, with measurable reopening tests rather than indefinite review.

Kill criteria: the events that revoke this verdict
• Reopen only after one current authority map identifies every proxy admin, timelock delay, Security Council threshold, pauser, oracle quorum, COOK execution path, and residual Mantle power
• Reopen only if no operator controls more than 33% of active mETH stake and at least eight independent operator groups are active for two consecutive quarters
• Reopen only after the exact buffer contracts, assets, balance, allocation rules, privileged roles, fallback path and loss allocation are published and independently reproducible, with no failed proposed-size withdrawal for 90 days
• Reopen only if median net mETH yield exceeds or matches both wstETH and rETH within 25 basis points over the same trailing 180-day window after all protocol and buffer costs
• Any native redemption request older than 30 days, any mETH backing loss, or any undisclosed change to buffer assets or allocation keeps the protocol rejected

The research file

The mechanism

A user sends ETH to the Ethereum Staking contract and receives mETH at the current exchange rate after an entry adjustment. mETH is non-rebasing: rewards increase the amount of ETH represented by each token. Mantle-operated off-chain allocator and initiator services select approved validator keys and coordinate deposits and exits; four disclosed professional operator groups—A41, P2P, Blockdaemon, and Stakefish—hold validator signing keys. Consensus withdrawals and execution rewards flow to protocol receiver contracts, and a ReturnsAggregator uses quorum-approved oracle records to account for principal, rewards, and fees. The protocol takes 10% of staking rewards.

mETH reported introducing a Buffer Pool upgrade in December 2025 to make mETH-to-ETH redemptions more efficient. The remaining live project recap does not disclose enough to verify the live buffer assets, capacity, authority or completion-time distribution. Those are open diligence items, not assumed features of the holder claim. mETH is distinct from cmETH; restaking through EigenLayer, Symbiotic, Karak, or Veda is opt-in through the separate cmETH product and is outside this entry.

Who controls it

The public contracts repository calls Mantle LSP permissionless but “governed by Mantle Governance.” Core contracts are upgradeable proxies; the deployment tooling prepares TimelockController calls for multisig execution. The repository also describes the Pauser as a centralized system callable by contracts or off-chain guardians. An independent Prisma risk assessment traced important staking-manager and aggregator-manager permissions to the Mantle Security Council, a 6-of-13 Safe: these roles can change exchange-adjustment and fee parameters. Oracle quorum thresholds and reporters, allocator and initiator permissions, validator operators, and upgrades are all privileged surfaces.

Governance disclosure is internally transitional. Mantle’s MIP-30 says mETH would remain non-custodial with the same four operators and Mantle Guardian/Security Council infrastructure, while protocol communications introduced COOK as the governance token able to influence strategic and operational decisions. The reviewed materials do not provide one current authority matrix separating binding COOK votes, Mantle votes, Security Council execution, and team-operated services for the base mETH contracts. Until live roles and governance execution are reconciled, “community governed” is not a usable control conclusion.

The record

mETH launched in December 2023. Its public repository and auditor archives show reviews by Hexens, Secure3, and MixBytes-related work. Hexens’ August 2023 pre-launch review found three high-severity and six medium-severity issues, including paths affecting withdrawn validator principal and protocol liveness; Hexens says the findings were fixed or acknowledged and its remediations were validated. Finding serious issues before launch is evidence the audit did useful work, not evidence of a production exploit. No reviewed source identifies a successful exploit of the base mETH contracts or loss of mETH backing.

The protocol’s 2025 review states zero slashing incidents through year-end. The February 2025 Bybit theft touched the wider ecosystem: an attacker held cmETH, and mETH Protocol says cmETH’s eight-hour withdrawal delay prevented an immediate exit; it reported no risk to mETH or Mantle funds. That is useful defense-in-depth evidence for the separate restaking wrapper, but it is not a stress test of base mETH validator losses. The newer buffer has less than one year of disclosed operation and no decision-grade public stress record for a simultaneous liquidity run and Ethereum exit queue.

The exit

Native unstaking is a FIFO request-and-claim process through the Staking and UnstakeRequestsManager contracts. Before the buffer upgrade, timing depended primarily on protocol processing and Ethereum’s validator exit queue. The protocol applies an exchange adjustment intended to allocate entry/exit queue reward drag to the transacting user rather than socialize it; that parameter is governance-controlled. Holders can also sell mETH on secondary venues and accept market depth and discount. No Mantle L2 transaction is required for the canonical Ethereum token’s native exit.

The surviving project recap describes the upgraded buffer as enabling more efficient mETH-to-ETH redemptions but does not establish a contractual maximum. Until current primary documentation supplies the exact routing, capacity and fallback rules, native queue timing remains the enforceable backstop and the monitor must separately track buffer assets, oldest request and claimable ETH.

The comparison

mETH, wstETH, and rETH all convert pooled Ethereum staking rewards into an exchange-rate-accruing receipt. mETH and Lido both charge a 10% headline fee. Lido has a broader and better disclosed professional operator set and much deeper liquidity; Rocket Pool permits independent operators through economic bonding and is the stronger decentralization benchmark. mETH’s four named operator groups and undisclosed allocation/client mix do not improve either comparison.

The buffer is mETH’s claimed differentiator: it aims to improve redemption efficiency without a fully idle reserve. Current live primary evidence does not show enough about its assets, capacity or authorities to quantify either the benefit or added dependencies. With base mETH yields tracking peers rather than beating them, convenience does not yet compensate for operator, governance, and buffer complexity.

Open questions

Before disposition, verify all Ethereum proxy admins, implementation addresses, TimelockController delays, Security Council signers and threshold, pauser and oracle reporters, COOK governance execution, and Mantle Governance residual powers. Pull validator-level data to quantify allocation among A41, P2P, Blockdaemon, Stakefish, and any newer operators, plus execution/consensus client and geography concentration. Reconcile the protocol’s current partners—later materials also name Kraken Staked—with the four-operator architecture.

For the buffer, identify the exact live contracts, assets, current balance, allocation thresholds, privileged roles, loss allocation, fallback rules and actual redemption completion percentiles since launch. Compare net realized yield and executable mETH/ETH depth with rETH and wstETH over the same dates. Unless this work establishes either meaningfully better liquidity without hidden gating or meaningfully better net yield, the rejection remains.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Mantle LSP contracts and roles · primary · accessed 2026-08-15
  Supports: upgradeable contracts, allocator and oracle roles, Ethereum deployments
• Mantle Governance MIP-30 · primary · accessed 2026-08-15
  Supports: Mantle governance, operator set, protocol transition
• mETH Protocol 2025 review · primary · accessed 2026-08-15
  Supports: reported slashing record, protocol operations, 2025 milestones
• mETH COOK governance announcement · primary · accessed 2026-08-15
  Supports: COOK governance claim, transition status, strategic control
• mETH Bybit incident update · primary · accessed 2026-08-15
  Supports: Bybit incident scope, cmETH withdrawal delay, reported mETH non-impact
• Hexens mETH security review · primary · accessed 2026-08-15
  Supports: pre-launch findings, severity, remediation status
• MixBytes public audit repository · primary · accessed 2026-08-15
  Supports: integration audit reports, review scope
• Prisma Risk mETH assessment · secondary · accessed 2026-08-15
  Supports: Security Council threshold, privileged roles, collateral risk
• Aave governance mETH onboarding record · primary · accessed 2026-08-15
  Supports: Aave market integration, asset risk parameters, Mantle deployment distinction
• Rated Mantle validator-operator page · secondary · accessed 2026-08-15
  Supports: validator operator telemetry, operator performance

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.