Penalties
The SSVLM is designed and structured with a penalty system to uphold the integrity and performance of Node Operators (NOs) and clusters. Managed by the Module Oracles and the Module Admin Committee, penalties aim to dissuade infractions, underperformance, and malicious behavior. This responsibility of the Admin committee may be coded programmatically and will be finalized in the final technical document that goes to snapshot to the Lido DAO.
Penalties are categorized into two types:
Bond Penalties
Bond penalties are applied in response to severe infractions that compromise the module’s operational integrity and reliability. These penalties result in the confiscation or penalization of the associated NO’s bond, ensuring that misconduct carries consequences.
The Module Admin Committee is responsible for monitoring infractions using its own tools or leveraging existing Lido on Ethereum protocol monitoring systems, such as MEV-monitoring to detect MEV theft, while the Module Oracles are responsible for enforcing penalties and reporting validator withdrawal proofs.
- Negative Validator Balance penalties are enforced when a validator’s withdrawal balance falls below the minimum required amount for a validator on the Beacon Chain to be activated (currently 32 ETH).
When one of the module’s validators is exited—either by the Module Oracles (due to an NO bond withdrawal request or a Lido protocol withdrawal request) or, post-Pectra hard fork, by the Lido on Ethereum protocol through an EIP-7002 execution layer exit request—a report is submitted to the SSVLM smart contracts containing the validator’s exited balance proof. The smart contract then validates the report against the beaconBlockRoot to determine whether the validator’s withdrawal balance is below the minimum deposit amount. If the validator’s balance is insufficient, the difference between the withdrawal balance and the minimum deposit amount is deducted from the managing NOs’ bond and penalized.
- MEV Theft penalty is a delayed penalty with a challenge period before final enforcement. The Module Admin Committee is responsible for detecting MEV theft, reporting it to the SSVLM smart contracts, and settling the report at its discretion during the challenge period.
Once an MEV theft is reported, the bond of all NOs managing the validator is confiscated, meaning it is locked within the SSVLM and cannot be withdrawn. The confiscated bond remains locked until the Admin Committee reviews the case and makes a settlement decision within the challenge period or until the NO voluntarily compensates the stolen amount along with a fixed stealing fee back to the module.
If no compensation for the stolen amount by the NOs is made and the challenge period elapses without a settlement decision, the bond is unlocked and returned to the NOs.
If the theft is confirmed, the bond of all managing NOs is penalized. In cases where the amount stolen exceeds the validator’s backing bond, the penalty is capped. The penalized bond amount per each NO is determined as the lower between:
- The total amount stolen divided by 4 (to account for all four NOs in the managing cluster)
- The total bond of the NO with the lowest bond among the validator’s NOs
Example scenario #1 - stolen amount is 10 ETH and each NOs has provided more than 10 stETH, 2.5 stETH would be penalized from each NO.
Example scenario #2 - stolen amount is 100 ETH and the lowest provided bond out of one of the NOs is 10 stETH → 10 stETH would be penalized from each NO.
Penalized bond amounts are burned as stETH shares using the Lido on Ethereum protocol Burner contract, effectively redistributing the burned stETH value among all other stETH holders.
Performance Penalties
Performance penalties are used for performance-related metrics that are tracked over longer periods. These penalties are applied to validators and are deducted from the rewards in the following rewards distribution cycle. Performance penalties incentivize consistent performance and discourage long-term underperformance.
- Validator Performance penalties are applied at the validator level and affect all NOs managing a validator that fails to meet the predefined validator performance threshold.
The rewards deducted due to performance penalties are redistributed among the NOs who meet or exceed the predefined performance thresholds, ensuring that rewards are allocated to NOs who actively contribute to the module’s reliability and performance.
Additionally, a NO Performance penalty mechanism is under consideration for potential future implementation. If introduced, this penalty would apply at the NO level to NOs who fail to meet the predefined NO performance threshold (e.g., not participating in at least X% of their active validators’ duties inherent to the SSV network during a distribution cycle). This safeguard is intended to prevent “free-riding” NOs within clusters, where DVT’s intrinsic fault tolerance can mask individual underperformance. The penalty would serve to better align rewards with active participation and contribution to cluster reliability and performance.
Module Economics
The SSVLM aims at creating a sustainable and competitive economy for all participants. Preliminary economic ranges are provided below, and will be finalized prior to the launch of the module via a Snapshot vote. To facilitate the decision-making process regarding SSVLM economics a separate detailed risk assessment which is done by Lido DAO contributors, for the Lido DAO and will be provided separately for community discussion with no obligations for Clusterform.
Staking rewards allocated by the Staking Router are distributed across three key areas:
-
Lido Protocol - A portion of the staking rewards supports the Lido protocol, contributing to its broader operational and development needs. The expected preliminary range is 4% - 6% of staking rewards.
-
Node Operators - NOs get a portion of the staking rewards, along with a portion of SSV incentives, which makes the module competitive within the staking landscape and attractive in comparison to other modules. Given that an expected launch data for the SSVLM would be following the Pectra hard-fork, initial slashing penalties would be reduced. This will allow for the SSVLM to offer a lower value bonding curve, while providing a market leading capital multiplier. The expected preliminary range is 2% - 3% of staking rewards.
-
Module Operations - A portion of the staking rewards are allocated towards module operations which reimburses the Module Oracles for their ongoing work in operating the module and supports Clusterform for the continuous development and scalability of the module, ensuring it remains sustainable throughout its lifecycle. The expected preliminary range is 2% - 3% of staking rewards.
Conclusion
The design of the SSV Lido Module (SSVLM) reflects the core goals of creating a permissionless, decentralized staking module that seamlessly integrates Node Operators into the Lido protocol validator set.
By leveraging Distributed Validator Technology (DVT) and a robust framework of Module Oracles, SSVLM addresses the unique challenges of secure key generation, cluster coordination, and NOs accountability while remaining competitive in the staking ecosystem.
The DVT-based architecture not only enhances fault tolerance but also enables greater decentralization and scalability, aligning closely with Lido protocol’s vision for a resilient staking protocol.
If approved by the LDO token holders voting through the Lido DAO voting process, this proposed design can serve as the foundation for the development and deployment of SSVLM as a scalable enhancement to Lido protocol’s decentralized staking infrastructure.
With the potential to eventually replace the SimpleDVT module, SSVLM offers a long-term, scalable solution that could evolve with Lido protocol’s needs.
Next steps
After discussion on the forum, this proposal will be presented to Lido DAO as a Snapshot vote to signal that Lido DAO supports this direction of work.
If the vote is supported by Lido DAO voters, the initial deployment on the Holesky testnet is targeted for Q2 2025.
After a successful outcome on Holesky and a codebase audit, Lido voters will have the opportunity to express their opinion in another Snapshot vote, which will include the technical details and parameters.
If supported on Snapshot, the next step will be the mainnet deployment, followed by a final on-chain vote aiming to integrate the module into the Lido on Ethereum protocol throughout H2 2025.
Appendix 1. Module Admin Committee
While the Module Oracles are responsible for the day-to-day operations of the SSVLM through automated software, there is a need for a dedicated mechanism (e.g. a committee multisig) to handle broader operational tasks and make decisions that require human judgement. An Admin Committee is proposed to fill this gap, focusing on the oversight of module functions and settings.
The specific processes and responsibilities of the Module Admin Committee are currently in the research and development phase, as the goal of the SSVLM is to automate as many processes as possible. It is proposed that, should the initial SSVLM proposal be successful, the details will be shared and voted on in a subsequent Snapshot vote that covers the technical implementation and parameters of the SSVLM.
Appendix 2. Verified Operators (VO) Program
The Verified Operators (VO) Program is an initiative to onboard NOs from the vetted list of SSV network’s VOs to the SSVLM by offering them favorable terms to encourage their participation.
Incorporating VOs into the module offers several significant advantages:
-
Reputable and Reliable NOs: VOs are typically professional entities with extensive experience in Ethereum staking and blockchain infrastructure services. Their participation ensures a high standard of reliability and professionalism in the SSVLM.
-
Long-Term Commitment: VOs are more likely to remain active participants within the module over time, as many of them operate professionally as businesses rather than solo NOs. This stability contributes to the module’s sustainability and growth.
-
Enhanced Sybil Resistance: Since all VOs are vetted and KYC’d by the SSV DAO’s VO Committee, their presence increases Sybil resistance within the clusters they are part of. This mitigates the risk of a single entity operating multiple operators within the same cluster, thereby reducing single point of failure risks.
-
Improved Performance: VOs’ professionalism and expertise create a strong foundation for better validator performance, benefiting the module and Lido on Ethereum protocol’s stakers by ensuring more consistent and performant validator operations.
Benefits for Verified Operators
-
Lower Bonding Curve - VOs will benefit from a reduced bond amount requirement for their managed validators. This allows them to manage more validators with less stETH requirements, making it more capital-efficient for them to participate in the module.
-
Prioritization in Cluster Formation - When forming DV clusters, the Module Oracles will prioritize incorporating VOs into clusters. This prioritization ensures VOs are included in cluster formations whenever possible, but it is not enforceable - clusters will still form without VOs if none are available in the NO queue for cluster formation.
The responsibility for whitelisting NOs as VOs will rest with the Module Admin Committee, which will whitelist the owner addresses of VOs approved by the SSV DAO.
Additional Terms
- Clusterform team shall retain all rights and interests, including intellectual property rights, in any proprietary modifications, enhancements, and integrations made as part of the services and deliverables provided under this Proposal. Any underlying open-source code remains subject to its respective open-source license.
- Clusterform may provide some of its obligations through affiliate entities or third parties, in its sole discretion.
- Services shall be provided on an “as-is” basis. The module is based on an available-to-all open-source code determining the services, as may be amended by the Clusterform team from time to time. Clusterform disclaims all warranties, express or implied, with respect to the services or deliverables. Unless in cases of wilful misconduct and fraud, Clusterform shall not be responsible for claims, damages, liabilities, losses, expenses and costs, direct or indirect, arising out of or resulting from this engagement, services, and deliverables, whether civil, administrative, criminal or otherwise. Nonetheless, excluding wilful misconduct and fraud, if a competent court or authority determines otherwise, liability will be limited to 50.000 USD for all claims.
- Clusterform shall perform its obligations independently. Nothing shall be viewed as establishing partnership, agency, employment or exclusivity relationship between Clusterform, Lido DAO, Lido DAO contributors, LDO token holders and/or any Lido DAO adjacent entity. Clusterform may make similar proposals in other projects or otherwise pursue similar endeavors to this Proposal. It is clarified and understood that this proposal does not create engagements between users of Lido protocol and Clusterform.
- Clusterform may stop supporting the services and deliverables in this proposal by giving a 3 (three) months notice, that will be published to the Lido DAO Research Forum, unless instructed to so earlier by a competent authority.
- The Clusterform team will make commercially reasonable efforts to maintain compatibility with the Lido protocol, but is not obligated to do so.
- The Clusterform team is committed to endeavoring to provide industry standard quality regarding the components of this module.