This article is a visual overview of the insurance protection behind three popular Liquid Staking Derivative Tokens (LSDs):

1. Lido’s stETH
2. Rocket Pool’s rETH
3. Stakewise’s sETH2

It aims to inform you about how the policies work and how much protection each pool has relative to each other. You can also skip ahead to the summary at the bottom.

The data and policy information gathered for this write-up were accurate as of 31 July 2022.

Background

You can find my notes here for a little more background on Ethereum staking and the definition of LSD tokens.

When using an LSD token, you delegate your validating duty to a node operator, who pools ETH from LSD users and stakes on their behalf. Picking a suitable liquid staking token involves much more than insurance coverage. You will need to look at things such as historical/projected APR, node operator count, custodian risk, and DeFi integrations, amongst many other factors.

It is possible to lose funds when a node operator’s validator does not perform their duty well (e.g., being offline or incurring various slashing penalties). Most LSDs offer insurance to protect users from the slashing downside. Understanding the risk is complicated because the penalties depend on the likelihood and impact of each different scenario. What is the appropriate amount of insurance? I will not be answering that here; instead, I hope to help you understand the insurance policies behind each of these protocols.

Lido

In Lido, trusted Node Operators run validators on their users’ behalf. Insurance in Lido has moved through 3 states via governance:

1. Purchase coverage from Unslashed
2. Opting for self-cover using 50% of protocol fees
3. Cap insurance fund and redirect revenue to other operating expenses

Currently, Lido has a treasury of (estimated) 4565 stETH + 920wstETH, which equals ~5533 stETH. In the case of a slashing, we expect Lido DAO to burn up to this amount of stETH to bring stETH supply to parity to staked ETH. Any ether slashed beyond 5533 ETH will start to eat into the backing behind stETH.

As shown above, the insurance provides coverage for the entire pool but is small compared to the slashable ETH at stake.

Given that Lido has:

• 4,140,832 ETH deposited
• 111,977 ETH in rewards

We can estimate that there are 128,401 validators with an average of 32.87 ETH in balance.

Per validator, Lido has, on average, 0.87 ETH in rewards and (5533ETH/128401 validators) 0.043 ETH in insurance cover.

Lido insurance can protect against:

• Entire pool leaks ETH:
  • Protection for loss of up to 0.0043e per validator (0.013%)
• Validator Ejection at 16eth:
  • Protection for ~328 validators ejected
  • Assuming validators are evenly spread across NOs, ~20% of 1 NO’s share
  • ~0.26% of the entire network
• Total validator loss:
  • Protection for ~168 average validators
  • Assuming validators are evenly spread across NOs, ~10% of one NO’s share
  • This is ~0.13% of the entire network

Lido has outlined more scenarios here.

Rocket Pool

Rocket Pool does not purchase insurance or have a fund. Due to its permissionless and trustless nature, Node Operators (NO) are expected to post collateral as insurance. Liquid ETH deposits are matched 1:1 with Node Operator’s ETH as collateral, as well as 10-150% worth of RPL.

The diagram below shows the assets behind each Rocket Pool Validator

Assets will be used to buffer penalties in the following order (from top-down in the above illustration):

1. Staking rewards
   1. Combination of 0.099 NO reward ETH and 0.073 rETH reward ETH
2. 16 NO ETH
3. 1.6 ETH to 9.38 ETH worth of NO RPL
4. LSD (rETH) user’s 16 ETH deposit

Even lesser rewards will be deducted when withdrawals are enabled. But essentially, rETH has (9.38 + (16 + 0.1724/2)) / (16 + 0.1724/2) = ~158% of slashing insurance per validator. This variable amount can go as low as 110% if the average RPL collateralization is at a minimum of 10%.

Rocket Pool insurance model can protect against:

• Entire pool leaks ETH:
  • Protection of up to 25.38e per validator (~79%)
• Validator Ejection at 16eth:
  • Protection of up to 99.47% of the network
  • Other than outstanding rewards, there is 0 loss to rETH holders in this scenario as it is fully borne by the permissionless node operators.
• Total validator loss:
  • If an entire validator is lost, the only insurance is Rocket Pool only protects up to 9.38 ETH (~58%) per validator using RPL. The pool will suffer a socialized loss of ~6.3 ETH out of 16.172 ETH worth of rETH issued, per validator lost.

Stakewise

Stakewise recently purchased three months’ worth of slashing insurance from Nexus Mutual in a trial purchase that will last until 17 October 2022. Research into Nexus Mutual’s capital pool shows that they have over 120k ETH, adding up to over 150k ETH worth of funds. This amount is sufficient to provide the ~6k ETH required to cover all Stakewise’s validators at 3 ETH each.

For each validator, we have

• 0.25 ETH coverage by Stakewise
• 3 ETH coverage by NexusMutual (policy wording here)
  • 0.25 ETH deductible
  • Covers penalty, loss of would-be income from downtime
• 0.67 ETH in rewards on average [(63335 ETH deposits + 1327.47 ETH rewards) / 1979 validators = 32.67128]

Combined with the deductible, Stakewise essentially has 3 ETH coverage per validator. As in the diagram above, Stakewise doesn’t have insurance at the pool level; instead, they have it at the validator level. The insurance provides a 3 ETH buffer against a total possible slashing penalty of 32.76 ETH for each validator.

Stakewise insurance model can protect against:

• Entire pool leaks ETH:
  • Protects up to 3 ETH per validator (~9.18%)
• Validator Ejection at 16eth:
  • Coverage is only up to 3 ETH per validator, so the pool suffers a loss of ~13 ETH (40%) per validator ejected.
• Total validator loss:
  • If an entire validator is lost, the pool will suffer a socialized loss of ~29 ETH out of 32 ETH worth of sETH2 issued per validator lost.

Summary

While all protocols have some form of slashing insurance, they behave differently across scenarios.

• Lido’s self-insurance only covers a very small margin of error (0.13% of value). This pooled insurance can potentially cover losses from any scenario, as long as the amount remains minuscule.
• Rocket Pool’s insurance is high as permissionless operators need to insure half of each validator. Losses exceeding 79% of validator balance will be socialized amongst rETH holders, regardless of # of validators affected.
• Stakewise’s per-validator slashing is flexible across scenarios and minor slashings, but may not be adequate for adverse scenarios.

Credits & Other References

Many thanks to people who have helped me gather data, answer questions, or review the research!

• Individuals from various discord communities
  • Stakewise (kiriyha)
  • Nexus Mutual (Gaulthier)
  • Rocket Pool (knoshua, uisce.eth, Ken)
• Friends who helped to review this
  • Jeng Yang
  • Jasper

Most references were already embedded within the article.

• Excalidraw illustration here

Disclosure & Afterword

I stake with Rocket Pool and hold some RPL tokens. I do this because it has the best chance of limiting downside exposure.

I view insurance as a tool to help users manage tail risks and unexpected scenarios. While a catastrophic event is improbable, the risk is real, especially if a pool runs a client software with a bug. To this end, I believe that Rocket Pool’s rETH is the most resilient LSD token in the face of unexpected software bugs or other operational risks.

rETH also aids the growth of decentralized staking pools to improve the resilience and censorship resistance of the entire Ethereum network.