Skip to content
Fuga Labs
Scope an engagement
Sector preset

Liquid staking

For a token that is a promise about a rate, held by every market that accepted it as collateral.

Scope an engagement Every sector preset
PresetonboardLstDetectors in play5Boundaries declared3Refusals at onboarding0

How this sector loses money.

A liquid staking token is a promise about a rate. Break the rate and you have broken every integration downstream of you at once, because every lending market that accepted your token as collateral reprices in the same block, whether or not anybody told them.

Answered by
  • 5Deterministic rules

What the preset configures.

One command, and this is its output. The identifiers at the foot are real, so you can diff them against the catalogue rather than trust the list.

onboardLst(platform, config) 6 configured
  1. 01The full contract set monitored as one subject
  2. 02Exchange-rate integrity against declared sources, evaluated continuously
  3. 03Vault share-price manipulation, including first-depositor and donation shapes
  4. 04Redemption-path drift alerting on the queue you actually run
  5. 05Proportional-drain detection across the staked position
  6. 06Authority surface: admin changes and upgrade diffs on every component
Detectors in play
  • rules.rate-integrity
  • rules.admin-authority-change
  • rules.upgrade-implementation-diff
  • rules.vault-share-price-manipulation
  • rules.proportional-drain

The perimeter, stated in writing.

Every edge, and the control that closes it. This is the list your auditor and underwriter will ask for, so it sits on the public page rather than an appendix.

The edge Slashing happens at the consensus layer, not in your contracts.
Closed by Closed at the layer where it matters to holders. A material slashing event is one that moves the redemption rate, and rate integrity catches the movement regardless of which layer caused it, which is the only version a downstream lending market cares about.
The edge Withdrawal-queue depth is protocol-specific and cannot be assumed.
Closed by Closed by modelling your queue at onboarding rather than a generic one, with redemption-path drift alerting configured against the mechanism you actually run.
The edge Your token's risk is inherited by every market that accepts it.
Closed by Closed by Exposure Map: the contagion graph carries look-through exposure downstream, so the markets holding your token learn about a rate break from the graph rather than from their own liquidation engine.

How it goes live.

Three rungs, in order, and each one written for this preset rather than for presets in general.

  1. Step 1

    Scope

    The full contract set as one subject, your redemption queue modelled the way you actually run it, and the rate sources you treat as authoritative. Markets holding your token are mapped in the same pass.

  2. Step 2

    Detect

    Rate integrity catches a movement whatever layer caused it, which is the only version a lending market downstream of you cares about. Share-price cover includes the first-depositor and donation shapes on the vault.

  3. Step 3

    Prevent

    The bounded action is a redemption pause, and it is the one most worth rehearsing: pausing the queue is itself a signal to every market that reprices off you. Report-only first.

What runs underneath.

A declared state invariant on the rate is the shared control that matters, because every market downstream of you is trusting a number you publish.

The base under all eleven presets

Scope Liquid staking coverage.

Every engagement is scoped by the team, and onboarding is performed by operators. There is no self-serve door, and that is a security decision first.

Scope an engagement Every sector preset