MultiSigs & Controls
This page is the single source of truth for who controls ether.fi, with what threshold, and after what delay. Every privileged power is listed with what it can do, what it explicitly cannot do, and a link to verify it onchain. The goal: minimize what any one party, including ether.fi, can do unilaterally, and make the rest checkable rather than asserted.
The most important boundary, true of every entity below: no key or multisig can move, redirect, or seize user funds. Privileged powers are limited to upgrading code (slowly, behind a public delay), changing parameters, and pausing. They can stop the protocol; they cannot take from it.
Controls at a glance
6-of-10 (3 internal, 7 external)
10-day timelock on everything
Upgrade any contract; grant/revoke roles; change oracle committee and quorum; change its own delay
Act instantly (every action waits 10 days, visible onchain); move or seize user funds; get a faster path than depositors
4-of-7 (6 internal, 1 external)
Instant pause; 2-day timelock for parameters
Pause/unpause; adjust rate-limit and redemption parameters; pause crosschain bridges and set bridge peers; confirm, extend, or lift blacklists; instantly revoke a compromised operations or guardian key via the RevokeAdmin
Upgrade contracts; change oracle membership or quorum; move or seize user funds
Oracle committee (EtherFiOracle)
3-of-3 (full consensus)
Per report, onchain
Submit the rebase report that updates weETH's exchange rate, by quorum
Move share value beyond the onchain 5% APR cap; add or remove its own members
Monitoring / pauser (key)
1 automated key
Instant
Pause core contracts the moment an attack is detected (pauses are time-bounded and auto-expire); blacklist an actively-exploiting address with an automatic 3-day expiry
Unpause; upgrade; move funds; change any parameter; make a blacklist permanent. Pause-only by design
Operations keys (automation)
bounded roles, no multisig
Instant
Execute oracle reports that already reached consensus; trigger rate-limited validator exits; queue/complete EigenLayer withdrawals (ETH returns to the protocol)
Move or seize user funds; mint unbacked weETH; upgrade; bypass oracle consensus or the APR cap. All holders queryable on the RoleRegistry
You can find the detailed Trust Matrix here.
How the separation works
Two multisig wallets divide authority so no single signer set can both rewrite the contracts and run them.
The Upgrade Admin (6-of-10) controls the most powerful actions, all routed through a 10-day timelock. That window is a public review period: proposed code is visible onchain for 10 days before it can take effect, and any depositor who disagrees can exit first. The Upgrade Admin gets no faster path than anyone else.
The Operating Admin (4-of-7) runs the protocol day to day. Its emergency pause is immediate and bypasses the timelock, because stopping an attack cannot wait. Its reach is narrow: pause and adjust parameters, but it cannot upgrade code, change the oracle, or touch user balances. Non-emergency parameter changes sit behind a 2-day timelock.
The two timelocks own the contracts: the Upgrade Timelock (10 days) owns the upgradeable proxies and the RoleRegistry; the Operating Timelock (2 days) holds the slower operating roles.
The exchange rate is bounded twice
weETH's value updates through oracle rebases. Two onchain bounds constrain every rebase: a report requires 3-of-3 oracle consensus (full agreement of all committee members), and it then passes an onchain 5% APR cap, with any over-cap report auto-rejected by the EtherFiAdmin contract. Even a fully fraudulent quorum cannot move share value by more than a small bounded amount per report (e.g., 1.37 bps per day)
Crosschain controls
weETH bridges follow the same separation: per-chain pause and rate-limit levers with the Operating Admin and per-chain controller Safes; verification-path changes through the Upgrade Admin and its timelock. Every active lane requires a full 4-of-4 quorum of four independent DVNs (Canary, Horizen, Nethermind, LayerZero Labs) with no single-verifier fallback, and mint authority on every chain is held by Safe-governed contracts, never an EOA.
Verify it yourself
Nothing here needs to be taken on trust. For any address above: open it on Etherscan and use Read as Proxy for the live owner/implementation/admin; for a multisig, getOwners() and getThreshold() return the signer set and M-of-N; for a timelock, getMinDelay() returns the delay in seconds (864000 = 10 days, 172800 = 2 days); every role holder is queryable on the RoleRegistry via hasRole(role, address).
What the July 2026 security upgrade changed
The controls hardening previously listed here as roadmap is now live: the 10-day Upgrade Timelock batch executed onchain on 2026-07-14. The upgrade was audited by Certora, including formal verification of the new role system and the pool's exchange-rate and solvency invariants (see Audits).
Consolidated RoleRegistry
A single tiered role system (upgrade-timelock-gated admin, scoped operations roles) so every privileged role is granted, revoked, and audited in one place. Roughly 30 per-contract roles were replaced by 9 tiered roles; the registry itself is owned by the 10-day Upgrade Timelock
Targeted isolation of an actively-exploiting address without halting the protocol for others. Monitoring can blacklist with an automatic 3-day expiry; the Operating Admin confirms/extends/makes permanent; the contract is upgrade-timelock-gated. For active-attack interception, not screening
A fast path for the Operating Admin to revoke a compromised operations or guardian key, closing the gap between detecting a compromised key and removing it. It structurally cannot revoke the timelock or multisig roles themselves
Time-bounded pauses
Emergency pauses by the monitoring key now auto-expire (bounded between 8 hours and 30 days), and the key must cool down before pausing the same contract again. Only the Operating Admin can pause indefinitely or lift a pause early
Bounded withdrawal finalization
Withdrawal finalization is capped per day by an onchain limit, and once a request is finalized its payout rate is locked in: later rebases cannot change what it pays out
Last updated