Restaking and the price of trust

PDF | EPUB

equanimiti, mcnut, adcv

This article borrows heavily from The Web3 Paradigm Part II by equanimiti, with permission. With thanks to: Myles O’Neil, Felix Lutsch, Artem Kotelskiy, Eugene Emilianov, Eddy Lazarin

Trust is a necessary component of economic activity and human collaboration. How trust has been built up in the corporate world has primarily been through reputation and law enforcement. Decentralized trust networks are a new type of coordination mechanism that allow individuals to trust each other for transactions at a distance, without having to trust an intermediary. Ethereum and proof-of-stake systems create a notion of collateralized cryptoeconomic security, whereby the native token is used as collateral by the suppliers of the network to provide decentralized trust. 

Restaking extends Ethereum’s cryptoeconomic security by creating a “marketplace for decentralized trust.” This is done by bringing together Ethereum restakers and validators (suppliers of decentralized trust) on one side, with seekers of decentralized trust (Actively Validated Services, or AVS') on the other. Note that Ethereum itself is, in principle, an AVS. Other AVS' can be bootstrapped to create new decentralized trust networks that provide specific services through restaking. 

The providers of restaked ETH must contend with the risk/return assessment of the network they are providing collateral to for security. Total Expected Return is an important component of cryptoeconomic security, in that a higher degree of return makes it more attractive for suppliers of decentralized trust to participate in the network.

In this article, we explore the restaking landscape in order to derive a simplified value driver framework for pricing restaking risks in these AVS networks. Our crude framework considers the “cost of trust” from decompositions used for pricing risk in capital markets:

Return on Trust = Price Return + Work Yield + Restaking Yield - Loss Given Default  

Restakers should evaluate the opportunities available to them in a systematic manner and determine whether the rewards are commensurate with the risks. There is a very high market expectation of restaking returns, as priced through numerous layers of points. Eventually, we believe that the market will have to contend with the reality of steady-state AVS unit economics and the affordability of their security budgets.

The Restaking Landscape

What is an AVS?

An Actively Validated Service (AVS) is a business that requires a high degree of trust to deliver utility and seeks to acquire that trust through cryptographic security mechanisms, rather than through traditional, centralized security models which rely on trusted intermediaries.

In the broadest sense, dapps, smart contracts and blockchains themselves all are delivered through cryptoeconomic security. Many services rely on the default security model of some of the largest networks such as Ethereum, which obligates a service to conform to that network’s standards. However some services may elect to create their own security model for a variety of reasons:

• Granular customization of specific rules, features, pricing or performance
• Full sovereignty over governance and operational decisions
• Innovation or novel mechanisms at the consensus or other protocol layers
• Neutrality
• Trust assumptions and specific security requirements

Unfortunately, a decentralized network with native cryptoeconomic security can prove to be expensive and complex to build from scratch. Indeed, the relative lack of success of many layer-1 blockchains points to the high cost and coordination complexity that is required to bootstrap a decentralized cryptoeconomic security network with many distributed validators. Further, the highly volatile token prices of many layer-1 blockchains frequently cause instability in the amount of cryptoeconomic security present in the network, as well as driving higher long-run cost of capital to these projects.

Although not a good proxy for decentralization, the inflation rate could be seen as a useful signal of how close the network is to seeking an equilibrium with respect to the number of validators it is trying to incentivize to join the network. In new, bootstrap-stage networks, such as Dymension, the inflation rate is extremely high as a way of compensating for attracting new stakers. This is a long-term sustainable expense only if the long-run network “earnings growth” overcomes the effect of dilution to pay for new validators to join the network.

What is Restaking? 

Restaking is the reuse of ETH stake for new Actively Validated Services (AVS) that impose new slashing conditions on the capital. Instead of bootstrapping an entirely new cryptoeconomic security from scratch with their native tokens, AVS' can ‘rent’ their security from Ethereum restakers. Restaking allows enhanced capital efficiency from the perspective of ETH restakers, while providing potentially more stable security for AVS', who are no longer at the mercy of the price fluctuations of their native token for the network's cryptoeconomic security. Ethereum’s vibrant economic and ecosystem activities have afforded ETH to become a superior, blue chip collateral asset, similar to the notion of ‘hard currency’. 

There are advantages for these services to ‘rent’ their security in ‘hard currency’ rather than bootstrap an entirely new cryptographic security system from scratch.

In a PoS security system, stakers accept opportunity costs and price risk of the token they must commit in order to validate the network. The network must provide a sufficiently high staking return in order to 1) attract depositors and 2) offset fixed costs for validators to be able to continue to provide the service. The more trust (stake) that is required to protect a service, the more it should cost, on an absolute basis, to satisfy capital allocators. Further, the more value a service provides, the more trust may be required. In the unit economics of an AVS, cost of security is an expense.

The economics of an AVS would require very large amounts of capital to natively provide this level of security, which ultimately means that a very large amount of utility and consequently cash flow should be expected from the service. AVS’ that are unable to generate sufficient value will be forced to find creative ways to fund this expense, such as through the inflation of a native token or ultimately face business continuity problems.

The premise of restaking is that renting capital is cheaper than purchasing and natively building stake. When pooled, both the size of security and the cost of security can indeed reduce the expense. As is the case in many physical inventory heavy businesses, renting can often be the correct decision for early or immature businesses.

From a balance sheet perspective, we move from a linear, single turn of leverage of user equity to a multi-layered, levered security model with amortization of capital across different demands for security. This comes at the tradeoff of more turns of levered risk to the underlying collateral.

From the perspective of an AVS, renting ETH collateral for amortized security is a bit of financial engineering that looks something like the position of debt relative to equity. We assume there will be a relatively inelastic demand for security, in the sense that it is an extrinsic variable. 

The more assets the AVS provides security to, the higher the demand will presumably be for collateral, thereby increasing the restaking fee, but for the same amount of assets to secure, there is no incremental pressure to increase security - though there may well be tension if security collateral is withdrawn and the restaking fees become more expensive.

The cost of security will be an equilibrium between supply and demand for restaking fees. Presumably, if an AVS is unable to meet payment obligations, restakers will have no incentive to deliver collateral for security and will withdraw their stake, thereby making the price of new security higher. If there is a higher supply of restaking collateral, the cost of security should, all else equal, go down for the AVS and therefore for the restaker.

What are the different types of AVS?

At time of writing, this is a bit of an illusion, as no AVSs are currently live, though some are projected to launch on mainnet reasonably soon. The taxonomy of AVSs is therefore quite speculative. However, we can imagine a landscape of WIP services and try and classify them in a useful way for identifying value and risk drivers. From an economic standpoint, the relevant taxonomy is likely to look at how AVS generate value and incentivize participation.

The below is a non-exhaustive list of AVSs at the moment, as new types of services may emerge in the future with lower dependence or relation to the underlying Ethereum base layer. 

What are the sources of AVS return?

We expect the restaking fee and its relation to the AVS unit economics to be the only source of truth regarding whether an AVS can sustainably rent security through restaked ETH and deliver an attractive return to restakers. The rewards a restaker receives also stack on an axis of less to more risk and less to more variability of rewards.

The simplest way to evaluate the sustainability of staking security models for AVSs is by drawing an analogy with the Debt Service Coverage Ratio (DSCR) from traditional business, where:

DSCR = Earnings / Total Debt Service

We can lightly adapt it to restaking and produce the Restaking Operating Affordability Ratio (ROAR)

ROAR = AVS Cash Earnings / Total Restaking Fees Due

Where AVS Cash Earnings can be decomposed into constituent parts:

AVS Cash Earnings = Profitability x Efficiency x TVL = AVS Earnings / Sales x Sales / Assets x Assets

With no history of operations for any AVS, we can’t really judge what level of ROAR is sufficient as of yet. Plainly, an AVS must be able to structurally afford the security expenses it needs, or it needs to rethink its security needs and find other solutions. If an AVS is too small to afford hard-currency payments for ETH collateral-backed validation back to the L1, one way to bridge the gap is through the issuance of native tokens as equity-like instruments until they can reach a size to slow the dilution. The proportion of the fee paid in non-volatile tokens or through native token dilution will determine whether the restaker should curate AVS selection from the perspective of a debt-holder or an equity investor.

This introduces, however, a notion of yield sustainability, similar to the one faced by a new layer 1 blockchain that has to inflate its issuance to pay for new security. The reflexive danger of native token issuance is that there are very few cryptoeconomic protocols that have found a sustainable balance between issuance and removal of issued tokens. Ethereum is one of the few major ones at the network level.

The propensity of AVSs to issue their own token is likely due, at least in part, to the possible market inefficiency in crypto that reduces the effective cost of capital for native tokens relative to other sources of capital. While in traditional business, equity issuance would be a hotly contested issue and usually the most expensive source of funding for a business, crypto seems to benefit from overly inflated earnings multiples that reduce the overall cost of capital for a new token.

To evaluate whether this issuance will be long-term sustainable, the restaker must determine whether the price return (earnings growth x multiple growth x supply change) of the native token will overcome the initial inflation period to attract restakers to provide security. The bootstrapping effect of renting security is a source of operational leverage that can help AVS scale faster than if they had to bootstrap their own L1 networks, and association with a restaking brand or ecosystem effectively underwriting the AVS can also bring umbrella benefits to the speed at which an AVS can build up to critical mass. Distributing native tokens also have additional go-to-market benefits by potentially tying in more alignment between participants in an AVS’ ecosystem for the long-run.

However, there is still a bit of a deja vu effect at play here, as the main purpose of restaking was to provide lower cost security through amortized collateral and avoid the inflation cost problem of bootstrapping an entirely new L1 from scratch to access cryptoeconomic security.

How do you measure the cost of trust?

In traditional finance, an equity investor’s total return is the sum of price return and dividend yield. That is:

Total Return = Price Return + Dividend Yield

Price Return can be further arithmetically decomposed into 3 value drivers: 

Price Return = Earnings growth x Earnings Multiple growth x Token supply change 

Dividend yield is the additional interim cash flow that is awarded to the providers of capital. All providers of capital typically receive the same dividend yield.

In decentralized trust networks such as Ethereum, there is an interim cash flow that is awarded to the providers of work. Work in the context of Ethereum is the participation in validating transactions by putting up 32 ETH as collateral for cryptoeconomic security. Unlike dividend yield, work yield depends on whether the ETH holder stakes or not. 

Total Return = ETH Price Return + Work Yield

This “work yield” is essentially negative for non-stakers who are diluted by the new issuance of ETH that is rewarded to the stakers. In some ways, the stakers can be seen as preference shareholders who are entitled to a scrip-dividend payment, and the non-stakers can be seen as ordinary shareholders who suffer a dilution. An example can be found in Appendix where we walk through a hypothetical example of how the total return for an ETH holder differs whether or not they stake. Meanwhile, the figure below shows the price return decomposition of ETH, which consists of change in gas fees in $, change in the network multiple and change in supply growth. Multiplying the three components over a specific period equates to the price return of ETH. 

The restaking economy adds a new dimension to the capital structure. An AVS renting cryptoeconomic security from ETH restakers will have quasi debt/equity characteristics. The hybrid nature of the restakers in the context of a theoretical AVS balance sheet comes from the fact that the restaking rewards will sometimes be paid out in ETH, sometimes in the AVS’ native token, or a mix of both. In the case that the restakers are paid their yield in ETH, they will be more akin to a “debt investor” in the AVS; the restaker does not explicitly benefit from the upside of the AVS economy. In the case that the restakers are paid a yield in the AVS' native token, they will be more akin to an “equity investor” in the AVS. In addition, there will be a notion of “seniority” or the perceived safety of the restaked ETH, depending on the number of times the ETH is restaked. The probability of “default” for a restaked ETH is likely to rise exponentially with the number of times the same ETH is restaked to secure another AVS. In the most favorable case, “attributable security” that is exclusively reserved by an AVS that gets paid a restaking yield in ETH could be considered “senior debt.” As the ETH is restaked more times across various AVS', the ETH will be deemed more “junior”.

In the case the ETH restakers in the AVS are rewarded in ETH terms, their total return is simply the restaking yield. Put another way, the restaker does not have direct exposure to the upside potential of the AVS’ economy. In the case that the ETH restakers are rewarded in the AVS’ native token, their total return includes the price return component of the AVS token. Therefore, the restaker cares about the upside potential of the AVS’ economy to the extent they hold on to the issuance.

Total Return = ETH Price Return + ETH Staking Yield + Restaking Yield 

where 

Restaking Yield = Restaking Yield (Non-Volatile Component % + AVS Token % x AVS Token Price Return)

Cost of trust for a single AVS:  The above informs our intuition that a restaker’s required return and therefore the “cost of trust” of an AVS network depends on three major factors: 

1. # of times ETH supplied to an AVS has been restaked (i.e. fewer times ETH is restaked = lower cost of trust)
   
   
2. The currency in which restakers receive restaking rewards (i.e. native token = higher cost of trust)
   
   
3. Price Return of the AVS token, which in the long-term will reflect business fundamentals 

It follows that restakers who get paid their restaking rewards in the AVS' native token will need to carefully consider the long-term sustainability of the network. The graph above shows the price return decomposition for Ethereum. We imagine that a similar exercise can be carried out on a forward looking basis for AVS' based on a restakers’ view on the business viability of an AVS they will be restaking to.  

Cost of trust for multiple AVS': The role of the AVS operators or LRTs is to aggregate TVL from restakers to restake to multiple different AVS' to compound the return on restaked ETH. We cannot quantify the underlying correlation between the different AVS' and the increased likelihood of slashing losses. Still, we acknowledge that as the ETH is restaked multiple times across various AVS', the expected loss given a single slashing event will grow. 

Equation for Return on Trust: Given the above, we derive a simple intuition on “Return on Trust” in an restaking economy. That is:

Return on Trust = ETH Price Return + ETH Staking Yield + Restaking Yield - Loss Given Default

What should the restaking return on an AVS be?

At the moment, there is no history and no notion of what a restaked AVS is capable of affording as security budget to providers of ETH collateral. We propose a simplified framework for evaluating what a hypothetical AVS, viewed as a business, could potentially afford when taking into account constraints such as the return that its token holders may demand.

In a nutshell, the amount of security that an AVS commits to its business should scale with the value or amount of activity executed on the AVS. Undercommitting runs the risk of interrupting the AVS or disrupting its operations. Overcommitting runs the risk of engaging in unaffordable expenses that do not provide additional marginal benefits for the AVS’ users.

Leveraged Work Yield (Restaking)

Illustrative, back of the envelope representation of what an AVS balance sheet needs to be, and what the minimum AVS Cash Earnings need to be on an annualized basis at various levels of required return to restakers (i.e. restaking fee or yield). We also show the corresponding ROAR ratio to signal sustainability, and compare to a situation where the AVS does not have enough security to run its service and another where it has too much security to afford.

‍

To be clear about the realistic expectations of these backwards-engineered revenue thresholds: to date, there are only a handful of projects on Ethereum that generate revenues of more than $100m a year, including Ethereum itself.

Today, EigenLayer and higher-leverage derivatives, such as Liquid Restaking Protocols, use the notion of points to attract initial capital to commit their collateral to restaking. This is a shrewd move, as it prevents committing to token dilution early on, and allows these protocols to change the criteria with which a point is valued in actual dilution or in hard-currency payments. With enough bargaining power, through higher committed capital, they could well decide to simply not give any monetary value at all and realize a 0-basis cost of capital. 

Until then, the market is pricing a points expectation in the ~40% range. Using our earlier framework, this suggests that in order to have a ROAR safely greater than 1, AVSs should be capable of generating at least a 40% return on equity equivalent to their native token. For low-margin crypto services, especially if asset efficiency is less than 100%, i.e. underutilized TVL to set aside loss reserves, the only way forward for a service operator is through higher balance sheet leverage. 

Who are the customers of AVS’?

Many AVS' can be thought of as value-added services to other infrastructure providers such as roll-ups. In this sense, AVS' can be thought of as B2B (Business-to-Business) services, rather than B2C (Business-to-Consumer) services. 

The market potential of AVS' that provide services to roll-ups today will be constrained by roll-up revenues. 12.8k ETH in gas fees generated by the top Ethereum L2’s in February implies a run-rate of 153.6k ETH in roll-up revenues. Let us assume for a moment that all roll-up revenues could be reallocated to AVS services. Currently, Eigenlayer has 3.535 million ETH restaked. This means in the most generous case where all L2 revenues could be redirected to AVS', the restakers will be passed on 153.6k/3.535m = 4.3% annualized yield. We note this annualized yield does not take into account any considerations for slashing risks and “loss given default,” which we explain in the next section.

If we restrict the market opportunity to sequencer profits (i.e. roll-up revenues minus Ethereum call data cost), then the number shrinks to 54k/3.535m = 1.5% annualized yield.

In reality, our suspicion is that most roll-ups will try their best to protect their sequencer profits and opt-in to services that either provide cost-savings (e.g. EigenDA provides cheaper data availability vs. Ethereum) or address a real technical gap (e.g. interop). Therefore in the early stages of AVS’ roll-out, it is possible that much of the staking yields will have to be paid out in the AVS' native token emissions. As mentioned in the cost of trust formula we’ve derived above, payment in the native token emissions, rather than ETH, will raise the cost of trust for AVS’. 

An interesting market dynamic may play out as +40% market expectations (as materialized through points) for restaking APR contend with the reality of AVS unit economics and scale. This expectation is even more challenging when contrasted against a lower share of profits from L2s as a potential source of restaking yield. 

Assuming 100% of all layer 2 profits accrue to restakers to pay for shared security–an impossible upper bound estimate at best–we are left with ca. 1.5%±0.5% in restaking yield to restakers. If that share of profits lands on a more reasonable, but still aggressive, 20% of all layer 2 profits accruing to restakers, we land at ca. 0.75%±0.25% in restaking yield. This would tie to at least one estimate from an emerging liquid restaking token (Jason Vranek from Puffer Finance) who recently estimated that ca. 0.5% in restaking yield would be "nice".

Loss Given Default: Slashing and other risks

The risks in restaking must be considered carefully, as user collateral is effectively rehypothecated to back multiple actively validated services. This means the restaker collateral is at risk of being slashed under entirely new conditions, which depend on many idiosyncratic factors beyond just cryptoeconomic validation activities.

EigenLayer’s risk documentation makes a very clear and persuasive affirmation that it does not rehypothecate staked tokens. However, there is definitely the notion of leverage, in that the tokens are reused multiple times, probably more akin to leverage in the sense of a bank multiplier.

The risks that accrue to restaked ETH start with the risk of slashing or operational risk to staked ETH. In a surplus management study for Lido DAO, we found that large slashing risks (single operator going 100% offline for more than 7 days) would have an impact of about 0.01% of all stETH. Operational risks were more damaging in a tail risk event such as a Prysm bug and a large withdrawal queue (0.315%)

These risks stack with restaking risks. When a restaker commits their ETH to securing an AVS, the ETH is ‘at stake’ in a similar way as with Ethereum staking. The node operator entrusted to perform validation activities must behave correctly to avoid having user collateral slashed. There is no finalized version of slashing conditions that would affect restakers, so we can only speculate what that likelihood might be. The priority is to maintain a balance of straightforward and accessible operation with no change to node requirements with high cost of corruption.

These risks are not entirely unlikely, in our view. Underwriting an AVS will likely prove to be very similar to underwriting credit for a regular business loan, and the capital at stake is now subject, to some degree, to operational and business risks rather than pure consensus algorithm mathematics. It also bears mentioning that there is also a moral hazard effect at play, as AVS’ that are unable to afford a native L1 to secure their activities will be incentivized to seek rented capital for the same at a lower cost, similar to an insurance underwriting moral hazard.

We can qualitatively frame the impact of losses, including slashing, as Loss Given Default, similar to a traditional finance analogue. The Loss Given Default captures the exposure to additional risks that ETH holders opt into:

• For non-stakers, LGD is 0
• For native stakers, Loss Given Default is given by the Probability of Slashing * Loss Given Slashing with additional idiosyncratic risk components depending on the approach chosen for staking
• For restakers, Loss Given Default includes the previous and adds Portfolio Loss Given Default of Restaked Services:some text
  • Idiosyncratic loss from slashing or other operational errors
  • Correlated loss between a slashing or loss event on one AVS with another
  • Correlated loss between Ethereum staking and an AVS

That said, we can only speculate what the sources of losses can be for restaking at time of writing.

This means that the Loss Given Default effectively increases with the number of turns the ETH collateral is restaked. The more opportunities for correlations to arise, the more likely it is that a yield loss event will occur.

That said, there are various mitigants to the potential loss outcomes that could result from slashing or operational error. The maximum loss for stakers on Ethereum is essentially capped at 50% of the collateral per validator. Similarly, one could expect pairwise correlations to find an upper limit for AVS and between AVS activity and Ethereum staking. We expect a final optimization curve for AVS selection to produce diminishing returns on account of LGD, such that there might be an optimal maximum number of AVS’ to allocate to.

The below curve assumes each AVS in the set is the same and that the average restaking fee is about 5%, on the upper bound of estimates of what roll-up revenues could generate.

Liquid Restaking Protocols

Liquid Restaking Protocols (LRTs) introduce a new dimension of aggregation and liquidity. When considered as balance sheets, unlike with Liquid Staking Tokens (LSTs) for Ethereum staking, the asset allocation strategy for LRTs involves a much more heterogeneous risk and return profile. Although curation of node operators is a key function for LSTs, they largely converge along similar dimensions and compete aggressively on price and performance.

LRTs representing themselves as an evolution over LSTs may well find that the final product does not match user expectations for a base asset. When mapped to a familiar, fiat, financial system, LSTs play the role of monetary policy transmission tools, similar to core bank deposits or government debt instruments. Where stETH is a base asset, an LRT is money management, i.e. more akin to a structured product or bond fund.

The purported benefits that LRTs bring are around AVS curation, namely, money management decision-making that maximizes restaked ETH return by generating AVS restaking fees, while minimizing loss given default. This decision-space improvement has to maneuver in a limited amount of margin headway to share between a larger number of participants. 

If the restaking fee return is insufficient to be a meaningful differentiator relative to staked ETH return, LRTs may be pushed into either taking on more risk by allocating to AVS’ with higher balance sheet leverage, or simply failing gracefully and defaulting to competing with LSTs around a narrow staked ETH return product.

Appendix: Work Yield

We illustrate Ethereum’s “work yield” concept using hypothetical numbers and familiar equity analogies. Ethereum’s “capital return policy” to its token holders is set-up as if:

• Stakers are preference shareholders that are entitled to cash dividends (i.e. user tips and MEV) + scrip dividends (i.e. new token issuance). The two make up total validator rewards.
• Non-stakers are ordinary shareholders
• All shareholders can benefit from share buybacks (i.e. user base fee burn)
  

As can be seen below, stakers get a higher yield at the expense of the non-stakers. Specifically:

• Staker’s work yield is 3.33%, made up of 0.29% cash dividend yield and 3.03% “scrip dividend” yield
• A non-staker’s work yield is -0.57% due to the dilution from the “scrip dividend” (i.e. new token issuance) issued to the stakers.  

In summary, crypto provides unified price returns to all tokenholders but varying levels of “work yield” depending on what type of token holder you are. This implies that those who provide work might have a different view of a token’s “fair value” to those who don’t provide work.

‍

‍

‍

‍