SUB006 · EigenLayer Cascade Slashing · SSAF

Attack Vector

AVS slashing is non-isolated across operator registrations. Single slash cascades across all AVS commitments.

Kill Chain

1Operator runs multiple AVSs.

2Single AVS slashes the operator.

3Restaked ETH drops below threshold for other AVSs.

4Cascade slashing triggers across all commitments.

Impact HIGH

Single slash triggers operator insolvency across all AVS commitments. Restakers lose from multiple protocols. Systemic risk scales with AVS count.

Severity

HIGH — systemic. No cascade circuit breaker in EigenLayer design.

Proof of Concept

1Identify operator with high AVS count and tight collateral ratios.

2Trigger slash in lowest-threshold AVS.

3Observe cascade as other thresholds breached.

Caveat

AVS slash threshold data not fully public — exact cascade trigger points require operator-level data not on-chain.

Detection Signals

▸Monitor operator restaked ETH vs total AVS slash thresholds.

▸Alert if single slash would cascade (ratio breach).

▸Track operator AVS registration count vs collateral buffer.

Findings

NP-SUB006-001 HIGH No isolation between AVS slashing conditions per operator.

NP-SUB006-002 STRONG EigenLayer docs acknowledge restaking risk but no cascade circuit breaker.

NP-SUB006-003 OPEN Cascade probability increases with AVS count.

Sorry

AVS slash threshold data not fully public — exact cascade trigger points require operator-level data not on-chain.

BOWERBOUNTY · 6 STAGES

✓discovery (vuln surface)

✓placement (attack vector)

✓materials (PoC code)

✓lighting (CLO brief)

✓validation (programme match)

○packaging (filed)

BOWER SCORE

83/100 · 5/6 stages complete