TL;DR
Lido Oracle 8.0.6 adds a temporary cap of 500 exit requests per Validators Exit Bus Oracle (VEBO) report. If the exit queue demand is larger, the rest is reported in the next frames (~5 hours each). This is an oracle-side change only - no contract or protocol changes. No action is required from anyone except the VEBO oracle committee members - they need to update to the new release.
Background
After the VEBO v3 upgrade, each exit request in submitReportData costs about 26.5k gas. At the same time, EIP-7825 (Fusaka) limits the gas of a single transaction to 2^24 = 16,777,216. In practice this means a report with ~600 exit requests may not fit into a single transaction by gas.
The oracle daemon clamps the gas of every transaction it sends. Without a cap on the report size, a large exit report (for example, during a spike of withdrawal demand) could need more gas than one transaction is allowed to use. In that case the pre-flight check fails and the daemon cannot submit the report at all - the report would be stuck until the demand shrinks.
The issue was reported to us by an external security researcher. It is not a vulnerability: no funds are at risk and report data stays correct - in the worst case a very large report would simply be delayed until the demand shrinks. We are shipping the fix well in advance as a precaution, not as a reaction to an incident.
The change
- Since ~600 requests may not fit by gas, the exit order iterator now stops after 500 exit requests per report as a safe default (~13.3M gas, ~20% headroom under the EIP-7825 cap). The limit is enforced the same way as the existing per-report balance limit and is the same for all oracle members, so reports stay deterministic.
- The remaining demand is carried over to the next frames. With a VEBO frame of ~5 hours, the maximum throughput is ~2400 exit requests per day.
- The transaction gas upper bound becomes a configurable TX_GAS_LIMIT env variable with the EIP-7825 cap as the default, and the daemon now logs when it clamps the gas.
Note that we recently increased the VEBO report frequency. So even with the cap, the daily exit-request capacity (~2400 requests) stays above the old value and above the network exit throughput of ~1800 validators of 32 ETH (57,600 ETH) per day. The cap does not slow down actual exits.
This is a temporary measure. The limit will be revisited as conditions change - the Gloas upgrade, per-request gas cost, and exit queue demand.
What does not change
- The exit order stays exactly the same. The iterator already puts operators with forced exits first, so the limit only stops the report earlier, it does not change the priorities.
- Hash consensus and report submission flow are untouched.
Implementation: lido-oracle PR #1012, release 8.0.6.