The Shadow Peg: Liquid Restaking Tokens and the Hidden Collateral Risk for AI DeFi Agents

On April 19, 2026, a LayerZero bridge exploit drained $292 million from KelpDAO’s rsETH vault — roughly 116,500 rsETH, or 18 percent of circulating supply. The attacker compromised internal RPC nodes and fed false data to a 1-of-1 DVN setup that was supposed to be a multi-party security layer. Aave, SparkLend, and Fluid all froze rsETH as collateral within hours. The oracle price had not yet updated. Borrowers whose positions were technically still healthy on-chain — by the numbers — were still wiped out by the freeze.

That gap between “the oracle says fine” and “the protocol locks you out anyway” is what I’m calling the shadow peg. It is the most consequential risk property that AI DeFi agents almost universally fail to model.

The Yield Stack

A liquid restaking token compounds two sources of yield in a single transferable wrapper. The base layer is Ethereum proof-of-stake staking rewards — currently around 3.4% APY for validators, net of MEV. On top of that sits EigenLayer’s restaking layer, where the same staked ETH backs a second set of commitments to Actively Validated Services (AVSes). EigenLayer had $19.7 billion in TVL and 1,900+ operators as of mid-2026, with slashing finally activated in April 2025.

The LRT protocols — ether.fi (weETH), Renzo (ezETH), KelpDAO (rsETH), Puffer Finance (pufETH) — aggregate operator selection and AVS delegation for depositors who don’t want to run their own nodes. In exchange for this convenience, depositors earn restaking yield on top of their staking base: roughly 2–3% APY additional, bringing total yields to 5.5–6.5% for major LRTs versus 3.4% for plain wstETH.

The catch: LRT/ETH is not a hard peg. The exchange rate is backed by the underlying validator positions plus any EigenLayer restaking rewards, minus the ever-present risk of slashing penalties. Each LRT is a soft-pegged derivative, and soft pegs fail in two distinct ways.

Two Failure Modes, One Token Class

Liquidity depeg is when the DEX spot price of the token crashes while the protocol’s actual backing is intact. The canonical example is ezETH in April 2024. When Renzo announced the REZ airdrop terms, panic selling hit DEX pools hard: ezETH dropped 18.3% against ETH in a matter of hours. But the validators were fine. The EigenLayer positions were fine. The Aave oracle — which was configured with TWAP smoothing and circuit breakers — held at approximately peg throughout. Borrowers using ezETH as collateral on Aave were never at liquidation risk from this event.

Backing-loss depeg is categorically different. When actual ETH is stolen or slashed from the backing vault, every unit of the token is worth less in real terms. The rsETH LayerZero exploit is the cleanest 2026 example: the attacker didn’t manipulate the price oracle — they took the ETH. DeFi protocols can’t wait for on-chain oracle confirmation in this situation; the rational response is to freeze the asset immediately and update collateral factors after incident review. This is exactly what happened. The oracle lag window, during which a borrower’s health factor looks fine on-chain while the underlying asset is impaired, is the shadow peg.

The distinction matters because AI agents that read only oracle prices will misclassify these events. A backing-loss event looks identical to no-event from the oracle’s perspective — until it doesn’t.

Health Factor Math

DeFi lending protocols express position safety as a health factor:

HF = (collateral_value × liquidation_threshold) / debt_value

With a single LRT collateral position:

HF = (LRT_price_ETH × LT) / (LTV × original_LRT_price_ETH)
   = LT / LTV × (1 - depeg%)

where LT is the protocol’s liquidation threshold (75% for wstETH/weETH on Aave and SparkLend), LTV is your loan-to-value at entry, and depeg% is the fractional price drop. The HF scales linearly with both the depeg size and your entry leverage.

At HF < 1.0, you can be liquidated. The breakeven LTV — the maximum at which you survive a given depeg — is:

breakeven_LTV = LT × (1 - depeg%)

For rsETH’s 22% worst-case depeg with LT = 75%:

breakeven_LTV = 75% × (1 - 0.22) = 58.5%

That means any position using rsETH as collateral with LTV above 58.5% was technically liquidatable on the April 2026 event — and the ones that weren’t liquidated were simply frozen instead, unable to add collateral or repay debt while the incident was under review. In practice, frozen collateral is a form of soft liquidation for any borrower who needed to roll their position.

⬢ loading artifact…

The artifact above places five protocols on the risk ladder. The X axis is restaking yield; the Y axis is worst historical depeg. Drag the LTV slider to move the liquidation-threshold contour. Bubbles above the orange line would be liquidated or frozen at that LTV. Click any bubble to see protocol details and your exact HF before and after the worst historical depeg.

Notice that wstETH (plain Lido, no restaking) sits in the bottom-left corner: near-zero tail depeg, accepted as collateral virtually everywhere, but only 3.4% APY. weETH adds 250 bps of restaking yield for a modest 3.1% worst DEX depeg — an acceptable tradeoff at reasonable LTVs. ezETH’s 18.3% depeg looks terrifying until you understand it was a liquidity event: the DEX crashed but the oracle held, meaning DeFi borrowers were unaffected. rsETH’s 22% is a true backing-loss event, and the chart marks it accordingly.

The Oracle Lag Window

Chitra and Pai’s 2024 paper on restaking security economics (arXiv:2408.00928) frames restaking as a game between AVS security buyers and validators who might find it more profitable to collude and steal than to perform honestly. Their key finding: the honest equilibrium holds only when the slashable stake exceeds the value at risk. The KelpDAO exploit was not an EigenLayer slashing event — it was an infrastructure compromise — but it demonstrates the same structural problem: when the underlying backing is breached, the LRT price oracle is a lagging indicator, not a leading one.

This lag window is the shadow peg. It exists because:

1. Oracle prices are updated at discrete intervals (often every few minutes for TWAP, or triggered by deviation thresholds).
2. DeFi protocols that detect an exploit freeze the asset as a precaution before any oracle update.
3. Borrowers in the window have impaired collateral but healthy HF readings, and cannot act.

AI agents that monitor HF in real time and trigger rebalancing only when HF < threshold will miss this entirely. The trigger should also watch protocol-level governance actions, on-chain collateral factor changes, and oracle circuit breaker events.

Protocol Risk Profiles

wstETH: The benchmark. No EigenLayer exposure, no restaking yield premium. Accepted as collateral by every major protocol. Suitable as the reference leg for any LRT position sizing exercise.

weETH (ether.fi): The largest LRT by TVL ($3.06B), with diversified operator selection across 100+ EigenLayer operators. The 3.1% worst DEX depeg reflects momentary liquidity pressure at ETHFI launch — not a backing event. Reasonable choice for moderate LTV collateral use.

ezETH (Renzo): The 18.3% depeg is a liquidity artifact, not a backing signal. However, the concentration risk in Renzo’s AVS selection and the smaller DEX liquidity pool mean future liquidity events could repeat. The DEX oracle gap risk is real even when backing is fine, because some protocols use DEX-derived oracles rather than TWAP with circuit breakers.

pufETH (Puffer Finance): Smaller TVL ($0.41B) means price discovery is thin. No significant depeg event on record, but thin liquidity means a large exit or protocol incident could move the DEX price substantially. Treat the lack of historical events as insufficient data, not proven safety.

rsETH (KelpDAO): The backing-loss event changes the calculus fundamentally. Post-incident, the protocol is in recovery and collateral factors have been reduced across all major lending markets. Any AI agent that held rsETH as collateral in April 2026 without monitoring the LayerZero bridge security posture was flying blind.

Defense Strategies

For AI DeFi agents using LRTs as collateral, the minimum viable risk management layer looks like this:

Position sizing with depeg margin: Set maximum LTV at breakeven_LTV - safety_buffer. For ezETH-class liquidity risk (18.3% historical), with LT = 75%: breakeven = 61.5%, use max LTV of 55%. For any backing-loss capable token, apply a larger buffer or avoid collateral use entirely.

Monitor protocol governance, not just price: On-chain collateral factor changes, guardian multi-sig actions, and circuit breaker events from oracle providers are earlier signals than HF degradation. Watch LiquidationThresholdChanged and equivalent events on Aave/SparkLend.

Distinguish depeg types at the data layer: Before placing any LRT as collateral, classify its risk profile: does it have meaningful on-chain backing audits, diversified operator selection, and circuit-breaker-capable oracle integration? A 20% depeg in a liquidity-only event (ezETH April 2024) and a 20% backing-loss (rsETH April 2026) require completely different responses.

Maintain an exit path: LRT/ETH DEX liquidity can evaporate during exactly the events when you need to exit. If your strategy depends on DEX exit at near-peg, you need to model the liquidity depth at stress prices, not just current spread. The recursive leverage analysis in The Recursive Ledger covers how fast this compounds in looped positions.

The fork-testing problem compounds this: agents validated on Foundry forks inherit a frozen oracle price that never depegs. Real-world LRT oracle behavior — TWAP lag, circuit breaker pauses, protocol freezes — is invisible in fork tests. As covered in Fork-Blind, oracle prices are one of the five properties that silently mislead AI agents through testing.

Takeaways

The shadow peg is the interval between a backing-loss event and a DeFi protocol’s collateral freeze — during which oracle prices look fine but the collateral is impaired. Liquidity depegs (ezETH, April 2024) and backing-loss depegs (rsETH, April 2026) are structurally different events that demand different risk responses. The health factor formula is simple — HF = (LT/LTV) × (1 - depeg%) — but it only accounts for price movement; it cannot account for collateral freezes, oracle lag, or thin exit liquidity. AI agents that optimize purely for yield — without modeling worst-case depeg, depeg type, and oracle response time — are carrying tail risk that doesn’t appear until it’s too late to hedge.