> For the complete documentation index, see [llms.txt](https://etherfi.gitbook.io/etherfi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://etherfi.gitbook.io/etherfi/security/security-and-risks/multisigs-and-controls/trust-matrix.md).

# Trust Matrix

This page answers one question per protocol surface: **who can act on it, how fast, and what bounds them.** It is the parent page's controls, viewed from the user's side. Every value is verifiable onchain: addresses link to Etherscan, and the parent page explains how to check each one.

Three reading rules:

* **Scope.** This matrix covers eETH and weETH on Ethereum mainnet, plus one summary row for crosschain bridging. Per-chain bridge controls are detailed in the crosschain section of the parent page.
* **"Timelocked?"** tells you whether the action waits behind a public onchain delay before taking effect. Emergency powers are intentionally instant; code changes are intentionally slow.

### The matrix

<table><thead><tr><th width="134.49652099609375">Surface</th><th width="145.9947509765625">Centralized / decentralized</th><th width="246.2100830078125">Who controls it?</th><th>Timelocked?</th><th>Bounds</th></tr></thead><tbody><tr><td><strong>Withdrawals (normal operation)</strong></td><td>Decentralized</td><td>You. Any eETH/weETH holder can request a withdrawal or redeem instantly through the <a href="https://etherscan.io/address/0xDadEf1fFBFeaAB4f68A9fD181395F68b4e4E7Ae0">redemption manager</a>. Finalization of queued requests advances with each oracle report</td><td>No</td><td>Instant redemptions draw from rate-limited buckets<br><br>queued withdrawals wait for the next oracle report cycle; finalization is bounded by an onchain daily cap, and once a request is finalized its payout rate is locked in</td></tr><tr><td><strong>Oracle / exchange rate</strong></td><td>Committee + code cap</td><td>3-of-3 oracle committee (full consensus of all members) submits each rebase onchain</td><td>Per report, onchain</td><td>Onchain 5% APR cap enforced by the <a href="https://etherscan.io/address/0x0EF8fa4760Db8f5Cd4d993f3e3416f30f942D705">EtherFiAdmi</a>: an over-cap report is rejected, so even a fraudulent quorum can move share value by at most roughly 1 bps of TVL per report.<br><br>Committee membership changes go through the Upgrade Admin behind the 10-day timelock</td></tr><tr><td><strong>Validator exits</strong></td><td>Bounded automation</td><td>Operations keys (no multisig) trigger rate-limited validator exits and queue/complete EigenLayer withdrawals</td><td>No, but rate-limited</td><td>Exited ETH can only land on protocol contracts (the protocol's staking-node contracts or the <a href="https://etherscan.io/address/0x308861A430be4cce5502d0A12724771Fc6DaF216">LiquidityPool</a>), never an arbitrary address.<br><br>Granting or revoking these roles requires the 10-day timelock</td></tr><tr><td><strong>Rate limits</strong></td><td>Multisig</td><td>Operating Admin (<a href="https://etherscan.io/address/0x2aCA71020De61bb532008049e1Bd41E451aE8AdC">4-of-7 Safe</a>)</td><td>Instant for emergency bucket changes;<br>2-day timelock for redemption parameters</td><td>Zeroing a bucket stops flow but moves nothing; raising limits only widens what the code already allows</td></tr><tr><td><strong>Crosschain bridging (weETH)</strong></td><td>Multisig + independent verifier quorum</td><td>Every message must pass a full 4-of-4 quorum of independent verifier networks (Canary, Horizen, Nethermind, LayerZero Labs).<br><br>Per-chain rate limits sit with multiSigs</td><td>Making any change is behind multisigs</td><td>No externally owned account holds mint authority on any chain; minting is held by Safe-governed contracts only.<br><br>A paused or failed lane stops transfers, it cannot mint unbacked weETH. Per-chain rate limits bound any single chain's blast radius</td></tr><tr><td><strong>Emergency pause</strong></td><td>Automated key + multisig</td><td>Monitoring key (<a href="https://etherscan.io/address/0x9af1298993dc1f397973c62a5d47a284cf76844d">pause-only</a>), Operating Admin (4-of-7)</td><td>No</td><td>The monitoring key cannot unpause, upgrade, or change any parameter; its pauses are time-bounded and auto-expire, with a cooldown before it can pause the same contract again</td></tr><tr><td><strong>Withdrawal flow (during an incident)</strong></td><td>Multisig</td><td>Operating Admin (4-of-7) can pause withdrawals instantly. Individual withdrawal claims can be invalidated (and later re-validated) two ways: through an oracle-committee report, or by the Operating Admin behind its 2-day timelock</td><td>Pause is instant; oracle-path invalidation takes effect when the report executes; the direct path waits 2 days</td><td>Invalidation blocks a claim from paying out; it never redirects the funds elsewhere</td></tr><tr><td><strong>Per-address freeze / blacklist</strong></td><td>Automated key + multisig</td><td>Monitoring can blacklist with an automatic 3-day expiry; the Operating Admin confirms, extends, or makes it permanent. Enforced by the <a href="https://etherscan.io/address/0x5585996E7cFE95f2D99e61168B8b35C66Ff99B18">Blacklister</a> on transfers, deposits, withdrawals, and redemptions</td><td>Freeze is instant; the Blacklister contract itself is upgrade-timelock-gated</td><td>Blocks transfers only: never burns, mints, or reassigns a balance. Reversible by the same authority.<br><br>Reserved for active-attack interception, not screening</td></tr><tr><td><strong>Unpause / unfreeze</strong></td><td>Multisig</td><td>Operating Admin (4-of-7)</td><td>No</td><td>The monitoring key deliberately cannot unpause; recovery always requires the multisig</td></tr><tr><td><strong>Signer keys</strong></td><td>Multisig self-administered</td><td>Each Safe manages its own signer set at its threshold: Upgrade Admin 6-of-10<br>(3 internal, 7 external), Operating Admin 4-of-7<br>(6 internal, 1 external)</td><td>Safe owner rotation is instant once the threshold signs</td><td>Signer-set and threshold are public onchain (<code>getOwners()</code> / <code>getThreshold()</code>); protocol role grants and revocations sit separately behind the 10-day timelock</td></tr><tr><td><strong>Code upgrades</strong></td><td>Multisig + public delay</td><td>Upgrade Admin<br>(<a href="https://etherscan.io/address/0xcdd57D11476c22d265722F68390b036f3DA48c21">6-of-10 Safe</a>)</td><td>Yes: 10 days, visible onchain</td><td>The delay is an exit window: depositors can review the proposed code and leave before it takes effect. There is no emergency upgrade path</td></tr></tbody></table>

### How to read this against "non-custodial"

Under the code deployed today, nothing in this table lets any party move, redirect, or seize a user balance. The instant powers (pause, rate-limit zeroing, freeze) all *stop* flows. The one power that could ever change that fact is a code upgrade, and it must sit in public view for 10 days before taking effect: that delay is the exit window, and depositors who disagree can leave before the new code goes live. That split is the design: emergencies are fast and bounded, changes are slow and reviewable.

To verify any cell, see **Verify it yourself** on the [Multisigs & Controls page](https://etherfi.gitbook.io/etherfi/security/multisigs-and-controls).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://etherfi.gitbook.io/etherfi/security/security-and-risks/multisigs-and-controls/trust-matrix.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.