All pages
Powered by GitBook
1 of 5

Security

Staking Risks

Staking of any kind is never risk-free.

Don’t invest unless you’re prepared to lose all the money you invest. This is a high-risk investment and you should not expect to be protected if something goes wrong. Take 2 mins to learn more

Staking Risk Overview

  • Slashing Risk: Staking assets carries the risk of loss if your validator(s), or validators in a staking pool, incur network penalties.

  • Smart Contract Risk: smart contracts may contain vulnerabilities that can impact the security and functionality of the staking service, putting your funds at risk.

  • Protocol Risks: Protocols, including updates they deploy, can introduce bugs or vulnerabilities to the staking protocol putting your funds at risk.

  • Liquidity Constraints: Staking ETH locks funds, potentially risking liquidity if needed urgently or in changing market conditions; assess your liquidity needs.

  • Staking Reward Variation: Staking rewards are determined by the protocol and can fluctuate, with no guarantee of future returns.

Slashing risk

Validators face staking penalties, which can result in up to a 100% loss of their staked ETH if they fail to fulfil their responsibilities.

When you stake with this service, Kiln will operate validator(s) on your behalf. If these validators are incorrectly operated, it is possible for a portion of the ETH you have staked to be slashed, meaning they are destroyed by the protocol.

Please read this article to learn more about Kiln monitoring and slashing and downtime mitigation.

Smart contract risk

It is important to acknowledge the inherent risk that the Kiln smart contracts may contain vulnerabilities or bugs.

Our smart contracts have undergone comprehensive audits conducted by industry leaders such as Spearbit and the Ledger Donjon. Access reports and read more about our security practices here and here.

Protocol risk

Ethereum, a rapidly evolving technology developed by a decentralized collective, operates independently of any central authority such as Kiln. It is important to note that, due to its nascent stage, Ethereum may contain potential errors or vulnerabilities. Consequently, these vulnerabilities could pose a slashing risk to the network.

Liquidity constraints

When you stake your ETH, it becomes locked in the staking process for a certain period of time, during which it is not readily available for immediate use or trading. This lack of liquidity can pose a risk if you need to access your ETH quickly or if market conditions change unfavorably during the staking period. It's important to consider this liquidity risk and assess your own needs for liquidity before engaging in native Ethereum staking.

Additionally, it's important to be aware of the bonding and unbonding periods involved in the staking process. These periods refer to the time it takes for validators to enter and exit the system, as well as the withdrawal queue duration, during which your validator will not be earning any rewards.

Before staking, it is highly recommended to familiarize yourself with these processes. You can find more detailed information in the documentation that follows.

Kiln is a technology services provider that operates a validator on your behalf on the Ethereum blockchain. It enables access to the staking process as defined by the Ethereum protocol developers and does not possess the ability to influence or modify its implementation.

Staking reward variation

Rewards are not guaranteed.

We invite you to read this informative article that provides insights into the expected staking rewards on the Ethereum network. It covers the various types of rewards and their characteristics in detail.

In summary, Ethereum staking offers two types of rewards: consensus layer and execution layer rewards.

Execution layer rewards tend to be less frequent but more substantial in value. On the other hand, consensus layer rewards are received more frequently but are relatively smaller in amount. These rewards become available for claiming once they have been "skimmed" or "withdrawn" by the protocol, which typically takes around five days.

It's important to note that all staking rewards are generated by the Ethereum protocol itself and are not determined or influenced by Kilnv or any other entity.

Audits & Bug Bounties

Kiln aims to provide a secured and enhanced experience of staking through the different Kiln On-Chain smart contract platforms.

On-Chain products have been audited multiple time by various security firms and are under exhaustive monitoring and security practices to limit security risks as much as possible.

Kiln Onchain Dedicated Staking v1

Resources

Resource
Link

Source Code (Smart Contracts only)

https://github.com/kilnfi/staking-contracts/tree/master

Ledger Live mainnet

https://etherscan.io/address/0x1e68238ce926dec62b3fbc99ab06eb1d85ce0270

Ledger Live testnet

https://goerli.etherscan.io/address/0xe8Ff2a04837aac535199eEcB5ecE52b2735b3543

Other mainnet and testnet deployments

https://github.com/kilnfi/staking-contracts/tree/master/deployments

Audits

Security firm
Audit link
Scope
Date

Ledger Donjon

not available

Smart Contracts

July 21st 2022 March 15th 2023

Halborn

Report

Smart Contracts

July 22nd 2022

Spearbit

Report

Smart Contracts

July 27th 2023

Ledger Donjon

not available

Ledger Nano Plugin

July 21st 2022 March 15th 2023

Bug Bounty

  • Cantina

  • Immunefi

A $1,000,000 max bounty program is live since 21 August 2023. All bug reports must come with a working PoC impacting asset listed in the "Assets in Scope" section of the program which only addresses smart contracts.

Kiln Onchain Platform ("v2")

Security firm
Audit link
Date

Spearbit

Audit report is available upon request here.

July 27th 2023

Kiln Operator Infrastructure

Kiln is SOC 2 Type I and SOC 2 Type II certified and has been undergoing multiple penetration testings and audits from third parties.

Certifications and audits reports are available upon request here.

Bug Bounty

  • Cantina

  • Immunefi

A $500,000 max bounty program is live since September 9th 2024. All bug reports must come with a working PoC impacting asset listed in the "Assets in Scope" section of the program which only addresses smart contracts.

Business Continuity

What happens if Kiln goes out of business?

In the unlikely event that Kiln becomes insolvent, we have a business continuity and disaster recovery plan which we were certified for as part of our successful SOC 2 Type II audits.

B2B customers of Kiln can retrieve pre-signed Ethereum validator exit messages which enables them to unilaterally unstake.

We also have an Ethereum-specific policy involving exiting all validators or transferring validation keys in case Kiln can no longer operate the service.

Source code

If you want to perform your own code review, you can use the verified contract links on common block explorers like Etherscan.

All the code is available under the BUSL-1.1 licence.

Ethereum - batch-deposit by Kiln

Smart Contract
Link

V2 Contract (Mainnet)

0x576834cB068e677db4aFF6ca245c7bde16C3867e

V2 Contract (Testnet - Hoodi)

V2 Contract (Holesky - Deprecated)

0x0866af1D55bb1e9c2f63b1977926276F8d51b806

V1 Contract (Mainnet - Deprecated)

0x9b8c989FF27e948F55B53Bb19B3cC1947852E394

Ethereum - dedicated

Smart Contract
Link

Consensus Layer Fee Dispatcher

0x462Dd07A79e5DDfBe0C171449C5c01788d5d03C3

Consensus Layer Fee Dispatcher (testnet - Hoodi)

0xbA4Fa860F199b6FE967b59cb2770eBD0996BaB6a

Consensus Layer Fee Dispatcher Proxy

0xE8EC6F702D68ded71112031D78bBFf959c7234C7

Consensus Layer Fee Dispatcher Proxy (testnet - Hoodi)

0x89770c115e3734616823EdFb48265Fb8CDe46A97

Execution Layer Fee Dispatcher

0xca4DD914fA713214844c84F153A5e1627536a7fC

Execution Layer Fee Dispatcher (testnet - Hoodi)

0xe2e49D584d48E2497E085E0A6AD5700A79aAff7E

Execution Layer Fee Dispatcher Proxy

0x72b4C52f18f52EbA3E4290a002dF7c387427b058

Execution Layer Fee Dispatcher Proxy (testnet - Hoodi)

0x311dABCfF556473C1B20510c93DbE15D8aC207a6

Fee Recipient

0x933fBfeb4Ed1F111D12A39c2aB48657e6fc875C6

Fee Recipient (testnet - Hoodi)

0x3d41f89eBa11A018909aF209ACfa4aaeD590c7Ef

Staking Contract

0x0A7272e8573aea8359FEC143ac02AED90F822bD0

Staking Contract (testnet - Hoodi )

0x4E686f28c58c20975e1Cc2a386403D3360ce6092

Staking Contract Ledger Live Proxy

0x1e68238ce926dec62b3fbc99ab06eb1d85ce0270

Staking Contract Ledger Enterprise Proxy

0x746d8A8FCAB7f829Fa500504f60D89C5CC1EA973

Staking Contract Enzyme Proxy

0x0816DF553a89c4bFF7eBfD778A9706a989Dd3Ce3

Staking Contract Kiln Proxy

0xEF650d5DbE75f39e2ec18A4381F75c8a4D4E19C8

Staking Contract Safe{Wallet} - Promo Offer

0xc9db9bf0c9c8fa30b09c45233e6a2d5eeff9abf3

Staking Contract Safe{Wallet} - Main

0xbbb56e071f33e020daEB0A1dD2249B8Bbdb69fB8

Staking Contract Consensys/Metamask

0xDc71aFFC862fceB6aD32BE58E098423A7727bEbd

Staking Contract Kiln Proxy (testnet - Hoodi)

0xBF0F4316bdf53c6A4F2359b285D74E972bba4Bc5

Ethereum - pooling

Smart Contract
Link

Nexus

0x8a113da63f02811e63c1e38ef615df94df5d9e70

Factory (Coinbase Cloud)

0x2d5e65ff87d986d18ac224e725dc654bec3a04cd

Pool (Coinbase Cloud Pool)

0x8eea6cc08d824b20efb3bf7c248de694cb1f75f4

Oracle Aggregator (Coinbase Cloud Pool)

0x4e6a0740aa4c89c7e36c430afe3dd3bec68b6aec

Pool (Coinbase Cloud Pool)

0xd54ede626441ae514b15743d6a78a74c664b30a2

Oracle Aggregator (Coinbase Cloud Pool)

0x99a6d933bd22040136b7ccd5dbc3acdf2c103be6

Factory (Kiln)

0xc63d9f0040d35f328274312fc8771a986fc4ba86

Pool (Kiln Pool)

0x00a0be1bbc0c99898df7e6524bf16e893c1e3bb9

Oracle Aggregator (Kiln Pool)

0xd9f56e8a1b159b1482ec3bb6ce742fa5ce084f4c

factoryHatcher

0xa748ae65ba11606492a9c57effa0d4b7be551ec2

treasuryHatcher

0x48005e62373277fbbe5584b351830b1b2ec1e3fd

poolHatcher

0x1d6103243d0507a9d1314bac09379bf57a5cf155

withdrawalRecipientHatcher

0x066b6c3fca9034395068eb9d442ee5041eac33dc

execLayerRecipientHatcher

0xdac8cf86ca42185ebce7ed2dbec9bc2be1734ffc

coverageRecipientHatcher

0x24d6e12fa25b7f8fc6b4bba0ea77fc643d7210d3

oracleAggregatorHatcher

0xc2c48fbfec0e61683133aaff32c9c2e98fd17788

exitQueueHatcher

0x24a1dfebaec4e501c2152a5e4a434b236fce3d3b

ONTO Wallet Staked ETH (owsETH)

0x0a3d5e898fa7e7d593a940486095c156c01a0b0c

Staking Rewards Partial ETH (srpETH)

0x18099b65842cada4d87075920986559d9216a5bf

On-Chain Staked Ethereum (ocsETH)

0x2401c39d7ba9e283668a53fcc7b8f5fd9e716fdf

CDP Staked ETH (CDPstakedETH)

0x2e3956e1ee8b44ab826556770f69e3b9ca04a2a7

Coinbase Wallet Staked ETH (cbwsETH)

0x30a4aa1d14d44f0f5bfe887447ab6facc94a549f

CoolWallet Staked ETH (cwstETH)

0x42ecf9bde9078d659663da66b97c4823f762005e

Crypto.com Defi Wallet ETH (cdwETH)

0x437636e4b984eae19045626aa269a89f906cf96c

Walletverse Staked ETH (wvETH)

0x594db36d6f3e747f2c7675659f712bf4d72a9f97

Giddy Wallet Staked ETH (GiddyETH)

0x5b1c9ee05794e9667806f1bd1c6ae6d196498183

Pooled Staked ETH (psETH)

0x5db5235b5c7e247488784986e58019fffd98fda4

Bitnovo Staked ETH (bnETH)

0x61ac42269d0035cd86c52b6c5bb299daa73c7135

CDP Staked ETH (CDPstakedETH)

0x7d4b92522df1c7d211cbab49148d9d260b5a5e41

Dakota Kiln Staked ETH (dkETH)

0x9995f241c6a0d5b712281dfd3bd0e0289a5f2a98

MEW_Coinbase Staked ETH (MEWcbETH)

0xba1613cf1ff0d7307315f1d98465e27877ad3f02

Veno Kiln staked ETH (VenoKilnETH)

0xe5faa3fcc7729c3ac7b4571207bb5978e5c33e81

Kiln Test staked ETH (testKilnETH) - (testnet - Hoodi)

0x2f0a183C2EE761Bd6f559fEA80b006cBFAfAd99b