Fallback behavior on oracle failure
EigenLayer's assessment for RD-F-051 — scored yellow on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
If EIP-4788 precompile returns an invalid or missing root (timestamp outside the 8191-slot ring buffer), EigenPod proof verification reverts. There is no fallback oracle and no fallback behavior — EigenPod simply cannot verify proofs for out-of-window timestamps. Native ETH restakers cannot checkpoint or exit until valid proofs are submitted within the valid window. The 8191-slot (~27-hour) ring buffer means short outages are recoverable, but a persistent consensus anomaly would halt native ETH restaking operations. Yellow: no fallback, but the failure mode is liveness (not funds-at-risk-immediately) and the ring buffer provides meaningful recovery window.
Sources #
- URLEigenPod.sol — getParentBlockRoot() calls BEACON_ROOTS_ADDRESS.staticcall(abi.encode(timestamp))EigenPod.sol getParentBlockRoot()retrieved 2026-04-28
- EigenPods Bug Fix Completed August 29, 2025 — consensus upgrade broke proof format; patched same day; no funds at riskEigenPods Pectra bug fix August 2025retrieved 2026-04-28
Methodology #
Identify the declared fallback behavior (pause, secondary source, last-known-price, revert) when the primary oracle reverts or reports a stale value.
See the full factor methodology and distribution across all protocols →