Active Defense
ether.fi does not rely on people watching dashboards to keep the protocol safe. The built-in controls are paired with continuous, automated monitoring and response from Hypernative, an independent security firm, so protective action can happen the moment something looks wrong rather than after a person notices.
Always-on monitoring and automated response
Hypernative monitors ether.fi's core contracts and bridge routes around the clock. When it detects an abnormal pattern, for example an unexpected mint or release on a bridge or an unusually large outflow, it can automatically trigger an on-chain pause. This response is set up in advance across weETH's bridge routes and core contracts, so it does not wait for a team member to be awake and at a keyboard.
How pausing works
Pausing is controlled by a dedicated role. That role is connected to the automated triggers above, and is also available to the team for manual use. A pause can fire on its own the moment a threat is detected, and the team can also pause directly. The existence of a pause role is not the same as relying on a person to push the button.
Automated pauses are time-bounded
An automated pause is deliberately not open-ended. Every pause triggered by the monitoring role expires on its own after a set duration, and the role must cool down before it can pause the same contract again. Only the Operating Admin multisig can pause indefinitely, extend a pause, or lift one early. This bounds what a compromised or misfiring monitoring key could ever do: the worst case is a temporary halt, never a permanent one.
The durations are set per contract, and are shorter the more user-critical the surface:
8 hours
eETH and weETH token transfers
24 hours
LiquidityPool, WithdrawRequestNFT, EtherFiRedemptionManager, PriorityWithdrawalQueue, WeETHWithdrawAdapter, Liquifier
48 hours
EtherFiNodesManager, AuctionManager, CumulativeMerkleRewardsDistributor, EtherFiRestaker
The same principle applies to per-address blacklisting: the monitoring role can blacklist an actively-exploiting address, and that blacklist expires automatically after 3 days unless the Operating Admin confirms or extends it.
During a confirmed, ongoing incident the pause (and any attacker blacklist) is re-applied before each auto-lift, so containment holds until the incident is fully resolved. The expiry exists to protect users from a stuck or forgotten pause — not to give an attacker a fixed window to wait out. Each value is verifiable onchain by calling pauseUntilDuration() on the contract (or BLACKLIST_DURATION() on the Blacklister). See MultiSigs & Controls for who holds each role.
Abnormal redemptions
Outflows and redemptions are watched continuously. A sudden, abnormal spike in outflows is one of the patterns that can trigger an automatic pause, which slows activity down while the team reviews what is happening.
Bridge limits
Every route that moves weETH between chains has an automated cap on how much can move within a set time window. These limits are enforced on-chain and take effect without any human action.
Last updated