On March 12, the EigenLayer governance forum posted ELIP-018: a mechanism to introduce an irreversible exit path for restakers. The proposal, labelled RETIRE (Retirement Enabling Terminal, Irreversible Restaking Exit), aims to finally untangle the multi-AVS commitments that have historically trapped users mid-process. The ledger remembers what the code forgot: exit complexity is the silent killer of restaking confidence.
I have spent the last two years auditing Layer 2 dispute resolution logic and modifiable state machines. The pattern is consistent — every time a protocol adds a 'graceful exit' without formally verifying its interaction with slashing windows, the surface area for catastrophic failures expands exponentially. ELIP-018 is no exception.
The Context: Why Exit Matters
EigenLayer currently allows ETH stakers to delegate their stake to multiple Active Validated Services (AVS). Each AVS has its own slashing condition, unbonding period, and operator commitment. Withdrawal is not a single action — it is a multi-step protocol that must respect each AVS's cooldown. In practice, a naive user who tries to exit while one AVS is in its slashing window may inadvertently leave the system in an inconsistent state, exposing their stake to penalties even after the intended exit.
This is not theoretical. During the 2024 bear market, a major LRT protocol suffered a liquidity crisis when three AVS misaligned their unbonding periods, forcing mass withdrawals that triggered a cascade of forced operator rotations. The event went largely unreported, but those of us who traced the transaction logs saw the pattern: the protocol's state machine lacked a single, unambiguous terminal state for a restaker.
ELIP-018 proposes exactly that: a new state called 'RETIRED' that, once entered, cannot be reversed. The restaker commits to an irreversible exit. No further slashing can occur. No future AVS commitments can be made from that stake. The exit is final.
The idea is elegant in its simplicity. But elegance does not equal safety.
The Core: Disassembling the RETIRE State Machine
Let me walk through the mechanism layer by layer.
The proposal defines a RETIRE module that interfaces with EigenLayer's existing DelegationManager, Slasher, and AVSDirectory contracts. To initiate an irreversible exit, a restaker first calls requestRetire(). This function begins a 'cooling-off' period during which the restaker must wait for the maximum unbonding window across all AVS they are currently opted into. For a restaker using EigenDA (window = 7 days) and a generic AVS (window = 14 days), the cooldown is 14 days.
After the cooldown, the restaker calls finalizeRetire(). This triggers a lockState() on the state machine — the stake's status is permanently set to RETIRED. The Slasher contract must now reject any future slash attempts that target this stake. The AVSDirectory must remove the stake from all active AVS sets.
On the surface, this sounds like a clean atomic transition. But the devil lives in the state transition functions.
I have reconstructed the pseudo-code from the forum discussion (no actual code has been published). The critical vulnerability lies in the order of state transitions: