Rocket Pool (rETH)

Effective control: sovereign. No issuer or chain operator can freeze or block this position.

The scheduled date is the outside bound. Kill criteria are checked every day, and a trigger reopens the memo that week.

THE SOVEREIGNTY-MANDATE STAKING LEG, kept ahead of Lido for that mandate. A node operator posts a 4 ETH bond per validator (16 at launch, 8 after Atlas) and the protocol fills the rest from pooled deposits; rETH is an exchange-rate token whose redemption rate rises as rewards accrue. Anyone can register a node. The official API on 2026-08-14 showed 4,152 registered operators and 1,449 active across 104 timezones, with 615,168 ETH staked. This memo counts active operators; the earlier ’3,000+ independent operators’ claim had no definition behind it and overstated the live set. Lido routes about 90% of its stake through a few dozen curated professional operators, which is the concentration a sovereignty client is avoiding. Saturn 1 shipped on mainnet 2026-02-18: megapools, 4 ETH bonds, ETH revenue sharing to staked RPL, caps on oDAO penalties, and constraints on the balance data the oDAO submits. Migration is early, 4,921 megapool validators against a legacy fleet near 898,000. Control is two-tier: the permissioned oDAO still reports the Beacon Chain balances that set the rETH rate, a power Saturn 1 constrained but did not remove, while the Houston upgrade (2024) put pDAO governance on-chain, retired the team guardian, and created an elected Security Council whose one fast power is an emergency pause. Track record: a critical withdrawal-credentials bug was reported through the bounty on 2021-10-04, before launch, so no funds were lost; Rocket Pool paid its then-maximum $100,000 and made key-scrubbing a standing oDAO duty. No protocol exploit in almost five years since, on audits by Sigma Prime, ConsenSys Diligence, and Trail of Bits. The Immunefi bounty tops out at $150,000 against roughly $1B at stake, the same thin shape the StakeWise rejection counted; it does not decide here because distribution, five clean years, three audit firms, and an elected council offset it, but it goes on the watch list, and a published audit of the full Saturn 1 release could not be verified, so the review holds that open. TVL is falling: $989.6M on DefiLlama at the 2026-08-14 review against a $3.17B peak on 2025-08-13, while Lido holds $17.85B; the gap is widening, and a shrinking protocol thins the exit. That exit is the binding limit: rETH burns at the protocol rate only while the 18,000 ETH deposit pool holds balance, and no forced-exit guarantee exists until RPIP-71 ships. Against that, rETH held the smallest discount of the major LSTs through June 2022. The 25% cap is the mitigation for a capacity-limited exit, and it holds.

Kill criteria: the events that revoke this verdict
• rETH secondary price more than 2% below the contract getExchangeRate() rate for more than 48 hours
• Active operator count (official API activeNodeOpsTotal) falling below 1,000 from the 1,449 baseline of 2026-08-14
• Deposit pool pinned at zero while a secondary discount persists for a week, or, once RPIP-71 ships, its redemption queue exceeding 30 days
• Any RPIP that gates node registration, or that expands oDAO power over balance reporting or penalties
• A pDAO vote cutting the rETH share of the Saturn revenue split
• Saturn 2 deployed to mainnet without a published audit

The research file

The mechanism

A node operator posts their own ETH bond and the protocol matches it with pooled ETH from rETH depositors to fill a 32 ETH validator. The bond has fallen in steps: 16 ETH at launch, 8 ETH after the Atlas upgrade, 4 ETH per validator since Saturn 1 shipped on mainnet 2026-02-18. Saturn 1 also introduced megapools, one contract per node grouping many validators in place of one contract per minipool. The official API reported 4,921 megapool validators on 2026-08-14 against a legacy fleet near 898,000, so the migration is early.

rETH is an exchange-rate token, not a rebasing one: the wallet balance stays constant and the rETH/ETH redemption rate rises as staking rewards accrue, net of operator commission. The API showed 5% network commission and a 2.21% rETH APR on 2026-08-14. Docs say the rate is computed from Beacon Chain balances the oDAO reports on-chain, which makes the oDAO report the price-setting input.

New ETH deposits enter a deposit pool capped at 18,000 ETH per community docs; the cap exists because queued ETH mints rETH before it earns, diluting APR. Node operators draw from this pool to launch validators. rETH can be burned for ETH at the protocol rate whenever the pool holds enough; when it is empty, redemption waits for ETH from exiting validators, and there is no operator-forced exit today. RPIP-71, rETH withdrawal liquidity via EIP-7002 forced exits, proposes letting the protocol force validator exits to guarantee redemption; at this review it is a governance discussion, not shipped.

Who controls it

Control is two-tier. The oDAO is a permissioned set of trusted nodes that reports the Beacon Chain balances setting the rETH rate, generates and submits reward trees, and scrubs malicious minipools, the defense added after the 2021 pre-launch exploit. RPIP-24 is its charter: caretaker, not governor. Historical membership has included Nimbus, EthStaker, CryptoManufaktur, Blockchain Capital, and Bankless DAO, and governance discussed shrinking from 16 seats toward 13; the exact current roster and seat count were not verified this pass, and the on-chain member list is the authority.

The pDAO is RPL holders. The Houston upgrade in 2024 moved pDAO governance on-chain, retired the team-controlled guardian that could disable protocol features, and created an elected Security Council with one narrow, quorum-gated fast power: an emergency pause. The pDAO can remove council members or disband the council. RPIP-60, Protocol Upgrade Guardrails, adds a mandatory delay between an upgrade passing and executing, with a Security Council veto during the window.

Saturn 1, verified shipped 2026-02-18, changed five things: megapools; 4 ETH bonds; ETH-denominated revenue sharing to staked RPL, replacing inflationary RPL rewards, with DAO-adjustable splits between RPL revenue, operator commission, and rETH; upgrade-delay enforcement; and guardrails on the oDAO itself, caps on how much it can penalize over time and constraints on submitted balance data to protect the rETH rate from faulty or malicious reporting. The direction matters: Saturn 1 constrained the oDAO but did not remove it, and the rETH rate still depends on oDAO-submitted balances.

Distribution

Anyone can register a node. The official API on 2026-08-14: 4,152 registered node operators, 1,449 active, across 104 timezones, with 615,168 ETH staked through the protocol. The commonly cited operator counts vary with definition: third parties report ~2,000 as of early 2026, one source ~3,900, and the numbers sit between the registered and active figures depending on whether a source counts registered nodes or nodes with live validators. This memo counts active operators, 1,449, and the kill criterion baselines there.

Open registration means concentration must be measured, not assumed. Allnodes is a major hosting provider for Rocket Pool minipools and megapools; the share of validators run by the largest single operator or hoster could not be verified from primary sources this pass. On clients, the Smartnode stack ships Geth, Nethermind, Besu, and Reth on the execution side and Lighthouse, Nimbus, Teku, and Lodestar on consensus, with operators choosing; the realized client split across the network was not verified.

The record

Mainnet launch was November 2021, delayed from October after Dmitri Tsumak, founder of rival StakeWise, reported a critical vulnerability through the bug bounty on 2021-10-04. The bug: the Beacon Chain deposit contract honors the withdrawal credentials of the first valid deposit for a validator key, so a malicious node operator could front-run the minipool’s stake transaction and take control of the pooled 16 ETH. No funds were lost because the report came before launch. Rocket Pool paid its then-maximum $100,000 bounty, and the mitigation became a standing oDAO duty: verify each validator key is clean before launch and scrub malicious minipools. The same class of bug also affected Lido, per Immunefi’s joint bugfix review.

Since launch, no protocol exploit in almost five years on mainnet. A false hack alarm circulated on X in 2023 and was debunked. Losses from operator slashing are absorbed first by the operator’s bond and staked RPL, then socialized across rETH; no specific slashing event that reached rETH holders was found, and no source surveyed reports one, though absence of evidence is not proof.

Audits: Sigma Prime, ConsenSys Diligence, and Trail of Bits in 2021, with follow-ups including Sigma Prime’s Atlas audit; rocketpool.net hosts the PDFs. The Immunefi bounty tops out at $150,000 for critical smart-contract bugs, 10% of funds at risk with a $15,000 minimum, paid in RPL. A published audit covering the full Saturn 1 code was not found from the sources reached this pass.

TVL: $989.6M on DefiLlama at 2026-08-14 against Lido’s $17.85B, about 18x larger. DefiLlama’s peak reading was $3.17B on 2025-08-13, so tracked TVL is down roughly 69% in twelve months, partly ETH price (the API showed ETH at $1,875). The API’s 615,168 ETH staked at that price is about $1.15B; DefiLlama’s method differs. Rocket Pool ranks fourth in DefiLlama’s liquid staking category at about 2.8% of it. A shrinking protocol means a shrinking deposit pool cushion, thinner secondary depth, and operator economics under pressure right after a tokenomics overhaul; the gap to Lido is widening, not static.

The exit

The primary exit is burning rETH at the protocol rate against the deposit pool, capped at 18,000 ETH, about $34M at $1,875. The pool’s balance floats with deposit and validator-launch flow, so primary capacity at any moment ranges from zero to the cap. When it is empty, redemption waits on validator exits, and no forced-exit guarantee exists until RPIP-71 or a successor ships. There is no guaranteed redemption path today; the 25% sleeve cap is the mitigation for that.

The secondary exit is rETH on Balancer, Curve, and Uniswap. Third parties report thinner depth and wider spreads than stETH. Current aggregate DEX depth against the $25M minLiquidityUsd floor was not verified this pass; the monitor carries that check.

The peg record is the strongest of the major LSTs. In June 2022, when stETH traded about 6% below ETH for weeks after Terra and Celsius, third parties report rETH held the smallest discount of the category, and it traded at a premium for stretches after the Merge because the deposit-pool cap made minting scarce. Since Shapella enabled withdrawals in April 2023, arbitrage anchors the price near the protocol rate whenever the pool has room in either direction. A sustained discount now signals the pool empty and exit demand exceeding validator-exit throughput, which is exactly what the 2% for 48 hours kill criterion is built to catch; a deposit pool pinned at zero while a discount persists is the early form of the same signal.

The watch list

Each kill criterion maps to something readable. The rETH rate: secondary price against getExchangeRate() on the rETH contract, on-chain and directly measurable. Operator distribution: the official API publishes nodeOpsTotal and activeNodeOpsTotal; active was 1,449 on 2026-08-14 and the criterion’s floor is 1,000. Hoster concentration (the Allnodes share) should be watched separately once a source for it can be established. The withdrawal queue: no public gauge maps cleanly to a 30-day queue today; the observable proxies are the deposit pool at zero plus a persistent discount, and the Ethereum-level validator exit queue, and RPIP-71 shipping would create a real, measurable redemption queue. Permissioning: any RPIP that gates node registration, and any change to oDAO powers over balances or penalties; Saturn 1 moved these in the constraining direction, so a reversal is the red flag. The migration: megapool validator count, 4,921 now, against the legacy fleet, and Saturn 2’s scope and audit coverage when announced. Revenue: Saturn 1 made the rETH, operator, and RPL split a DAO dial, and a vote that cuts the rETH share cuts client yield directly.

Comparison and approved-with-limits decision

Compared with Lido stETH, rETH spreads validator operation across a permissionless node-operator set and gives the holder a distinct governance and implementation stack, which is useful diversification. It does not win on every dimension: rETH has materially less aggregate liquidity, primary redemption depends on deposit-pool capacity, and Rocket Pool retains pDAO and oDAO control dependencies that solo staking does not. Compared with solo staking, rETH removes the 32 ETH, hardware and validator-operation burden and provides a transferable receipt, while adding protocol-contract, oracle-reporting, operator and secondary-market risks. The approved-with-limits decision therefore treats Rocket Pool as a capped complement to Lido rather than a universally superior staking route. The 25% cap, discount trigger, operator floor and unaudited-upgrade trigger preserve that comparative rationale.

Open questions

Six things could not be verified this pass and the next review must resolve them. The current oDAO roster and exact seat count: historical names and the 16-to-13 discussion were found, but the on-chain member list was not read. The largest single node operator or hosting provider’s validator share. The realized consensus- and execution-client split across Rocket Pool nodes. A published audit covering the complete Saturn 1 release; the Saturn info site should be checked for the audit list, and the kill criterion on Saturn 2 shipping unaudited exists because this gap is already visible at Saturn 1. Current aggregate rETH DEX depth against the $25M registry floor. Whether the 18,000 ETH deposit pool cap survived Saturn 1 unchanged.

Also open: Saturn 2’s scope and timing, since the Saturn info site documents Saturn 0 and 1 only, and whether any slashing event has ever reached rETH holders; none was found, but that is absence of evidence, not proof.

Sources

The claims above trace to these. Where a number could not be independently verified, the thesis says so.

• Rocket Pool official API, mainnet payload, read 2026-08-14 · primary · accessed 2026-08-14
  Supports: active node operators, total node operators, megapool validators, protocol balances
• Saturn 1 info site · primary · accessed 2026-08-14
  Supports: Saturn 1 scope, megapools, bond and revenue changes, release status
• Rocket Pool post-mortem, withdrawal-credentials exploit, October 2021 · primary · accessed 2026-08-14
  Supports: October 2021 incident, withdrawal-credential exploit path, response and remediation, loss allocation
• Houston upgrade announcement, 2024 · primary · accessed 2026-08-14
  Supports: Houston upgrade, pDAO governance, security council, minipool and RPL changes
• RPIP-71 forced-exit governance thread · primary · accessed 2026-08-14
  Supports: proposed forced exits, rETH redemption queue, EIP-7002 dependency, proposal status
• DefiLlama, Rocket Pool protocol page, read 2026-08-14 · secondary · accessed 2026-08-14
  Supports: protocol TVL, rETH market survey, historical scale
• Immunefi bounty page · primary · accessed 2026-08-14
  Supports: bug-bounty scope, maximum award, severity terms
• Rocket Pool docs — direct protocol and CoW Swap routes · primary · accessed 2026-08-15
  Supports: rETH exchange-rate accrual, deposit-pool capacity, protocol route, secondary route, mainnet rETH contract

Inherited controls

The verdict above grades the protocol layer. Every position also inherits the asset it holds and the chain it settles on. The least safe layer sets the position’s grade, and the position table names which one that is.

Live positions