Renzo (ezETH liquid restaking)

Rejected venues wait the longest for re-review; a rejection has to earn another look before the scheduled date.

REJECTED. ezETH is a non-rebasing claim on Renzo’s pooled ETH and stETH, restaked through EigenLayer across operators the team selects. Every control that matters sits with role holders, not with the token holder: the contracts are upgradeable behind a multisig whose threshold the documentation never states, no timelock is described, an oracle admin can repoint any collateral price feed, a pauser role can halt deposits and withdrawals, and a minter-burner role can burn ezETH from any holder’s address with no allowance, a power the public repository shows and the user documentation never mentions. The protocol has one realized stress event on record: on 2024-04-24 ezETH traded to $688 on Uniswap against an ETH price above $3,100, leveraged holders were liquidated on Gearbox and Morpho, and no protocol withdrawal existed to hold the price to backing. Renzo revised its airdrop terms and never published a post-mortem. Deposits have since fallen from a self-reported $3.5B peak to about $113M. Direct ETH, Lido stETH or Rocket Pool rETH give a client the staking exposure without an administratively selected AVS loss surface, an unstated slashing waterfall, or a confiscation-capable role. The allocation is zero.

Kill criteria: the events that revoke this verdict
• The multisig threshold, signers and an enforced timelock are published and reconcile to the deployed contracts for 12 consecutive months
• A written slashing waterfall documents how validator and AVS losses distribute across holders and what funded capital absorbs them first
• The burn-from-any-holder minter-burner power is removed or disclosed in user-facing documentation with a stated control
• A post-mortem of the 2024-04-24 depeg publishes the price path, liquidations and the protocol’s structural fix
• Net restaking rewards exceed the approved plain-staking alternative by a written margin for 12 consecutive months, with a verifiable active bug bounty and proposed-size exits passing written time and slippage limits

The research file

Mechanism and holder claim

A depositor sends ETH or stETH and receives ezETH, which Renzo describes as ”a reward bearing token like Compound’s cTokens”: rewards accrue to the exchange rate rather than to the balance. The rate is protocol-computed, not market-set. RenzoOracle values the collateral through Chainlink feeds with a 24-hour staleness window, mints against the share of value added, and redeems a pro-rata share of TVL for the ezETH burned. Native ETH queues in a deposit contract until 32 ETH fills a validator whose withdrawal credentials point at an EigenPod. The pooled stake is delegated to about five institutional node operators the team chose; Renzo names Figment and notes Figment carries its own slashing insurance. Renzo passes EigenLayer rewards through and takes a 10% fee on restaking rewards, split between treasury and operators. The documentation never states how a validator or AVS slash is distributed across holders. The pro-rata redemption math implies it is socialized, and no protocol first-loss capital is documented anywhere; the only insurance named is the operator’s own policy.

Governance and control

The contracts are upgradeable proxies and Renzo says the upgrade permission ”is gated by a protocol multisig contract”; the threshold, the signers, and any timelock are stated nowhere in the issuer’s materials. A single upgradeable RoleManager gates everything else: an oracle admin who can repoint any price feed, an operator-delegator admin, a pauser for deposits and withdrawals, a token admin who can pause the token, and a minter-burner. The minter-burner power is the sharpest fact in the record: EzEthToken.burn(from, amount) burns any holder’s balance with no allowance check, and the user documentation does not disclose it; it is visible only in the public contract repository. REZ, the governance token, votes on Snapshot with a 100M-REZ quorum, and only whitelisted wallets can submit proposals for on-chain execution. REZ holders do not control the contracts today; the role holders do.

Incident record: the April 2024 depeg

On 2024-04-24, after Renzo published REZ tokenomics that the market read as thin on user allocation, ezETH broke from its backing on the venues where it traded: about 18% to roughly $2,642 within minutes on the main pools, and to $688 on Uniswap at the bottom. Holders who had looped ezETH as leveraged collateral were liquidated on Gearbox and Morpho. The structural cause was that no protocol withdrawal existed: redemption shipped only in May 2024, its audit is dated after the event, so arbitrage could not hold the market price to the oracle rate. Renzo’s response was to revise the airdrop, raising the Season 1 allocation from 5% to 7% and moving the claim date, per its own launch post. It never published a post-mortem of the depeg, and its documentation does not mention the event. No contract exploit or protocol principal loss is on the record; the loss path ran through market structure the protocol had built without an exit.

Exit and liquidity

Standard withdrawals now exist on Ethereum mainnet only. ezETH locks in a withdrawal queue and burns at claim; Renzo states an expected wait of 7 days while the buffer holds assets and 10 to 15 days when it is empty, sitting on top of EigenLayer’s 14-day minimum delay and beacon-chain exits. An instant route charges a fee that rises as the buffer drains and reverts once the buffer would fall below its floor, and it shuts off entirely when the protocol is paused. The pauser role can halt withdrawals outright. Under stress the configuration degrades toward the April 2024 shape: instant exits revert, queued exits stretch to two weeks, and the secondary market carries the price. Renzo has also said it will gate withdrawals behind anomaly detection once EigenLayer slashing is live.

Scale and assurance

Renzo’s own launch post claimed $3.5B in deposits and a third of the restaking market in April 2024. On 2026-08-21 DefiLlama reports about $113M, a decline of roughly 97% from the claimed peak, ranking second among liquid restaking tokens behind Kelp’s rsETH, which this registry also rejects. The audit roster is real and public: Halborn on the core and the withdrawal system, Sigma Prime, a Code4rena competition, and Nethermind in 2025, with reports in the public repository. No formal verification is claimed. The documentation advertises a $250k Immunefi bounty, but both Immunefi links now return not-found pages, so an active bounty could not be verified. A shrinking pool matters here: the exchange rate is a share of TVL, and a small pool behind a large role surface is a worse trade than the same roles over the pool that existed at peak.

Named alternatives and decision

The comparison is direct ETH staking, Lido stETH, or Rocket Pool rETH, not another restaking token. Each alternative carries validator, contract and liquidity risk; none adds an AVS set chosen by a team, an oracle a role can repoint, or a burn-from-any-holder power the holder was never told about. Against Kelp, the other rejected LRT in this registry, Renzo’s record is different in kind: Kelp realized a $292M bridge failure and restored backing; Renzo realized a market-structure failure it has never written up. Both fail the same test. The premium restaking is supposed to pay is neither durable nor separately measurable in the primary record, and the added loss surfaces are administrative rather than compensated. Rejected at zero.

Observable reopening conditions

Reopen only after Renzo publishes the multisig threshold, signers, and a binding timelock that can be reconciled to the deployed contracts; documents the slashing waterfall, stating in writing how a validator or AVS loss distributes across holders and what if any capital absorbs it first; discloses or removes the minter-burner’s burn-from-any power in user-facing terms; and publishes a post-mortem of the 2024-04-24 depeg. Require twelve months of realized restaking reward history net of fees that beats the plain-staking alternative, a verifiable active bug bounty, and TVL sustained above a level where proposed-size queued and secondary exits both complete inside written time and slippage limits. Until those observations exist, ordinary staking is the simpler exposure and the rejected allocation remains zero.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Renzo documentation — ezETH product and FAQs · primary · accessed 2026-08-21
  Supports: cToken-style accrual, accepted deposits, 10% restaking fee, reward pass-through
• Renzo documentation — withdrawals and instant withdrawals · primary · accessed 2026-08-21
  Supports: 7-day and 10-15-day waits, withdrawal queue burn-at-claim, instant-route fee and buffer floor, pause disables instant exits, mainnet-only withdrawals
• Renzo documentation — architecture, operators and protocol FAQs · primary · accessed 2026-08-21
  Supports: upgradeable proxies behind a multisig, EigenPod deposit flow, team-selected operators, Figment slashing insurance
• Renzo documentation — REZ tokenomics and governance · primary · accessed 2026-08-21
  Supports: Snapshot voting, 100M REZ quorum, whitelisted proposers, intended REZ scope
• Renzo public contract repository — RoleManager, EzEthToken, RenzoOracle · primary · accessed 2026-08-21
  Supports: role inventory, burn-from-any-holder, oracle admin can repoint feeds, Chainlink staleness window, pro-rata rate math
• Renzo documentation — audit roster and bug bounty claim · primary · accessed 2026-08-21
  Supports: Halborn, Sigma Prime, Code4rena, Nethermind, withdrawal audit dated May 2024, $250k Immunefi claim now unverifiable
• Renzo — REZ token launch post (Mirror, retrieved from Arweave) · primary · accessed 2026-08-21
  Supports: $3.5B peak deposit claim, revised airdrop terms, 7% Season 1 allocation
• The Block — ezETH depegs 18.3% after REZ tokenomics announcement · secondary · accessed 2026-08-21
  Supports: depeg magnitude and trigger, $2,642 within minutes
• Cointelegraph and CryptoSlate — depeg low and liquidation cascade · secondary · accessed 2026-08-21
  Supports: $688 Uniswap low, Gearbox and Morpho liquidations
• DefiLlama — Renzo protocol TVL · secondary · accessed 2026-08-21
  Supports: $113M current TVL, second-ranked LRT behind Kelp, chain split

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.