Thanks to Grant Southey, Jeff Tang, Kingsley Okonkwo as well as Status and Lido teams for their inputs and review
This post outlines the high-level design, rationale, and risk model for Linea’s Native Yield feature. Native Yield will allow ETH bridged to Linea to earn Ethereum staking rewards, which will then be distributed as incentives to users providing liquidity across Linea’s DeFi ecosystem. The mechanism is built to maximize capital efficiency, maintain full non-custodial control of user funds, and uphold the protocol security guarantees of the Linea rollup.
We aim to release those changes on mainnet in Q4 2025.
Motivations
ETH is the most secure and capital-efficient asset in the Ethereum ecosystem. However, when bridged to Layer 2 networks, it remains idle in most cases, neither accruing yield nor contributing to on-chain liquidity.
Our goal is to make Linea the most attractive chain for ETH capital, combining strong yield opportunities with sustainable, positive-sum economics, all while providing the same security guarantees.
To achieve this, we must move beyond the current incentive model that dominates DeFi. Most ecosystems rely on token emissions or ecosystem grants to attract liquidity. These incentives are often short-lived: once they expire, liquidity providers move on, and depth quickly evaporates. This creates a cycle of unsustainable growth where rewards primarily benefit sophisticated actors who can rotate capital across chains.
Our aim with Native Yield is to provide a more sustainable model, benefiting liquidity providers by offering predictable, competitive returns without forcing constant capital rotation, while also improving the broader DeFi experience for users, enabling deeper liquidity, tighter execution, and more reliable access to borrowing and trading at scale.
System Overview
Key Properties
Our design emphasizes trust-minimization and safety at every step:
-
Non-custodial: User funds are staked trustlessly via smart contracts. No one ever holds the withdrawal keys or can misappropriate users’ ETH. Staking Node Operators cannot access or take custody of the principal; they simply perform staking duties, with withdrawal credentials set to a secure contract. This ensures that even while earning yield, the bridge remains non-custodial and Node Operators have zero direct access to user funds. Additionally, with the introduction of EIP-7002, unstaking can be forced directly by the contract, further strengthening non-custodial guarantees and ensuring that funds can always be withdrawn according to protocol rules, even in the event of Operator failure or malicious behavior.
-
Bridging and withdrawals: Participating in native yield does not alter the normal bridging flow for users. Users who deposit ETH on L1 still receive ETH on L2 without requiring any additional steps. When withdrawing, users continue to get their ETH back on L1 without new delays. The system maintains a Liquidity Buffer of unstaked ETH to fulfill the typical withdrawal volume immediately. In worst-case scenarios of unusual mass withdrawals, the bridge enables immediate exit by allowing a direct withdrawal of the Liquid Staked Token (stETH) as a fallback, so that users don’t have to wait for unstaking.
-
Governance and Operator protections:
The native yield design ensures that user withdrawals remain fully permissionless and censorship-resistant. With Lido V3 and stVaults, operators cannot block or seize funds, and governance risk is further minimized through additional safeguards and the ability for vaults to attach and detach from the protocol. While a permissioned operator helps maintain an appropriate level of (unstaked) ETH liquidity, their capabilities are limited, and anyone can trigger key actions if needed, ensuring users always have independent access to their assets.
Bridging Flow and Liquidity Buffer
Users bridge ETH to Linea the same way they always have. The bridged ETH remains securely held in Linea’s native bridge contract as part of the Liquidity Buffer, a reserve of unstaked ETH designed to support fast, permissionless withdrawals back to Ethereum L1. The size of the Liquidity Buffer is governed by parameters defined by Linea’s Security Council, such as a minimum percentage of deposited ETH or a fixed threshold amount. These parameters ensure that the buffer is always sufficient to satisfy user exits during normal conditions without delay.
Yield Generation via Lido V3 stVault
A permissioned operator (“Native Yield Operator”) is responsible for periodically transferring excess ETH (i.e., funds above the Liquidity Buffer threshold) to a designated staking contract. This is done using Lido V3’s stVault primitive, which introduces significant new features compared to the current Lido protocol. Below are the key characteristics of this new design:
-
ETH is staked through Node Operators selected by Linea.
-
No stETH is minted by default. ETH is staked directly via the stVault, and rewards accrue internally to the vault.
-
The validator’s withdrawal address is set to the vault, isolating funds and rewards at the blockchain level.
-
Linea Protocol retains full control over the vault, including managing configuration and triggering withdrawals, ensuring a fully non-custodial setup.
-
Staked ETH can be used as collateral to mint stETH if additional liquidity is required (see withdrawal process). These stETH tokens represent a debt obligation and must be redeemed by the Operator to restore the vault’s collateral balance.
A more detailed description of the Lido V3 stVault can be found in their whitepaper.
Yield Harvesting and Distribution
Staking rewards accumulated in the stVault are harvested at regular intervals to be distributed on L2 through the native bridge. These funds are sent to a distribution smart contract. A zk-coprocessor tracks reward eligibility, determining who should receive rewards and in what proportion, based on criteria defined by the Linea Consortium. The zk-coprocessor then updates the distribution contract with a Merkle tree periodically. Users can then claim their accrued rewards on L2.
Withdrawal and Rebalancing
When a user wants to bridge ETH back to L1, it is withdrawn by default from the Liquidity Buffer, the same pool of ETH that receives deposits. To ensure sufficient liquidity, the Native Yield Operator monitors the buffer level and actively rebalances it by unstaking ETH from the stVault when necessary. This ensures withdrawals relying on the Liquidity Buffer are processed without additional latency.
In the exceptional case where the Liquidity Buffer is temporarily depleted, the user has the option to wait for ETH to be unstaked or receive stETH as fallback. stETH has deep liquidity on the open market, where it typically can be traded for ETH with minimal slippage and tight spreads to get instant liquidity. This guarantees that users can always access funds at any point. If the Native Yield Operator fails to maintain sufficient liquidity levels, any user can permissionlessly trigger the unstaking process to replenish the Liquidity Buffer and prevent withdrawals from being blocked.
Key Roles
-
Node Operators
These are responsible for provisioning and operating the Ethereum validators. They perform staking duties but have no direct access to user funds. -
Linea Security Council
The Linea Security Council is the owner of the stVault. It also defines operational parameters of the Linea Bridge, such as how much ETH can be staked and how much must remain in the Liquidity Buffer for withdrawals. -
Native Yield Operator
This is a permissioned role responsible for managing the Native Yield mechanism. The Operator can stake/unstake ETH, deposit to, or withdraw from the stVault, and repay stETH debt to manage liquidity. In practice, it is an automated system run by the Linea team (and potentially additional trusted parties in the future). Its goal is to maintain the Liquidity Buffer and ensure solvency of the vault at all times. -
Permissionless Users
If the Native Yield Operator fails to maintain safe liquidity levels, users can step in and permissionlessly trigger key actions, such as unstaking or vault rebalancing, to ensure continued access to ETH funds and preserve the system’s non-custodial guarantees.
Risks and Mitigations
Implementing Native Yield introduces certain risks. Below, we outline the main risk categories and explain how the design mitigates each to protect user funds.
Risk 1: Users Losing Their Funds
LST Governance/Administrator Risk
By integrating with Lido, the bridge inherits some dependency on Lido’s protocol governance. A primary concern is whether any privileged roles within Lido could maliciously seize or freeze user funds. However, in Lido’s architecture, no single administrator can arbitrarily steal funds as Node Operators do not have custody of deposits, and withdrawals are managed exclusively by smart contracts.
While Lido’s DAO could, in theory, upgrade contracts or adjust parameters, this authority is strongly checked by Dual Governance. In this model, stETH holders have veto power over critical proposals. This ensures that even if LDO token governance were compromised, stETH holders can collectively block or sufficiently delay malicious changes.
Additionally, Lido V3 introduces an “escape hatch” mechanism designed to protect against governance risks. If a threat is detected, stVault can opt out of DAO control entirely while preserving full ETH withdrawal capability. This “escape hatch” mechanism can be triggered and executed within the time taken to pass a DAO vote, ensuring users can exit before a possible unwanted (e.g. malicious) governance decision takes effect. Together, these measures significantly reduce the risk of a governance attack affecting user funds.
For example, an attempt to redirect or freeze the bridge’s stake would require broad consensus across both LDO and stETH governance, making a hostile takeover highly unlikely.
In emergencies, Lido includes a GateSeal “emergency brake” that can pause user withdrawals. A 3-of-6 multisig committee manages it and auto-expires after approximately 11 days if not extended. This mechanism offers short-term protection against an exploit but cannot permanently trap funds. In other words, it simply buys time for the DAO to respond.
In summary, no single administrator or Operator within Lido or the bridge can confiscate or irreversibly lock user funds.
Slashing Risk
When staking ETH, there is a possibility of validator slashing penalties, which could reduce the staked amount. In extreme cases (e.g., catastrophic validator failures), up to 100% of a validator’s stake could be lost, though this has never occurred on Ethereum. More commonly, slashing events are minor, with only ~0.04% of validators historically ever being slashed. When this happens, it usually results in a small reduction in rewards rather than a loss of principal. In most cases, any slashed amount is quickly offset by ongoing validator rewards, often within hours.
With the Lido V3 stVault, we will be selecting Node Operators directly, prioritizing those with exemplary track records who have never experienced a slashing incident and who maintain the highest operating standards.
As an additional safeguard, we will maintain a dedicated slashing insurance fund. This fund will be provisioned by temporarily retaining a portion of the Node Operator fees and used to compensate for any potential losses resulting from slashing events.
As a result, for bridge users, the risk of losing funds due to slashing is extremely small.
stETH Secondary Market Price Risk
In Lido V3, staking via stVaults does not rely on stETH as a store of value or to earn yield. Minting stETH is optional, and in the case of the Native Yield bridge, will only be used to provide liquidity for user withdrawals. When stETH is minted, it represents debt issued against the staked ETH held in the vault. Because of this design, a depeg of stETH on secondary markets does not affect the intrinsic value or solvency of the vault itself: the underlying ETH remains fully staked, and the vault’s collateral remains intact.
However, secondary market exchange rate deviation from 1:1 (steth:ETH) may trigger increased redemption pressure on the broader Lido protocol (“Lido Core”), which guarantees 1:1 redemptions. In such cases, the protocol may initiate a forced rebalancing, withdrawing a portion of ETH from affected stVaults to repay outstanding stETH liabilities. This process does not affect the staker’s principal; only the leveraged portion used to mint stETH is reduced to restore systemic liquidity.
The impact on the vault is primarily a reduction in size (i.e., a smaller staking position), not a loss of funds. As a result, the vault may earn slightly less yield until the withdrawn ETH is restored or re-staked, but no capital is slashed or forfeited. This mechanism preserves redeemability for stETH holders while ensuring that vaults remain overcollateralized and secure.
Risk 2: Withdrawals Being Delayed or Censored
Dependency on Operators for Withdrawals
A critical security goal is ensuring that users can always withdraw their funds from L2 back to L1 without requiring permission from any permissioned operator. In some earlier yield integration designs, withdrawals were not fully trustless. For example, Blast’s architecture requires an admin to manually approve each yield withdrawal step, creating a potential single point of failure or censorship. Linea’s design explicitly avoids this.
On Linea, ETH bridging remains fully permissionless. If sufficient ETH is available in the Liquidity Buffer, a user’s withdrawal is processed exactly as it is today, with no extra steps or approvals required. This guarantees a seamless, trustless withdrawal experience under normal conditions.
To keep the system running smoothly, specific operational tasks to manage the staking operations are delegated to Native Yield Operator. These include managing the Liquidity Buffer, performing staking and unstaking operations, and handling debt repayment to maintain vault solvency. Crucially, these roles are strictly limited: they cannot withdraw funds externally and can only move funds between system components (e.g., the bridge, vault, and staking contracts) within protocol-defined guardrails such as minimum liquidity thresholds and vault health ratios.
Even in a worst-case scenario, if the Native Yield Operator goes offline, users remain fully in control. The protocol includes permissionless functionality that allows anyone to trigger unstaking, repay liabilities, and rebalance the Liquidity Buffer. This ensures the system remains censorship-resistant and guarantees that users can always exit.
Withdrawal Delays
Withdrawals might be delayed if there is insufficient readily available ETH liquidity. This could happen if a very large number of users all withdraw at once (a “bank run” scenario), exhausting the bridge’s on-hand ETH reserve. The mitigation for this is maintaining a prudent Liquidity Buffer on the bridge. The system only stakes a portion of the total assets, keeping a significant reserve of ETH un-staked so that typical daily withdrawals can be paid out immediately from this reserve. The size of this buffer is configured based on observed activity and risk tolerance. It’s kept large enough to cover the expected volume plus a safety margin. The Operator will also dynamically replenish the reserve: if the buffer starts running low, unstaking will be proactively triggered. This proactive rebalancing prevents most delays.
Only in extreme cases where withdrawals far exceed normal levels (e.g. sudden panic by virtually all users) would the buffer be fully depleted. In that scenario, users have two options: wait for the unstaking process to deliver fresh ETH (which usually takes on the order of a week due to Ethereum’s withdrawal queue), or opt to receive stETH immediately as an alternative. By offering stETH as a direct fallback, we give users a choice to exit immediately with the liquid token if they prefer not to wait. The net effect is that even under strain, users are not left in limbo: they either get ETH as soon as it’s available or can switch to an equivalent staked asset and exit instantly.
We must note that the ability for users to withdraw stETH as an immediate exit option is subject to the collateralization requirements of the stVault. Specifically, the stVault enforces a reserve ratio, which determines the maximum amount of stETH that can be minted against a total amount of ETH in the vault. If this threshold is reached, users will no longer be able to select the stETH withdrawal option until the vault is rebalanced and the debt is repaid. However, the system is designed so that the permissionless rebalancing is triggered well before the maximum threshold is reached. This mechanism ensures that the vault remains sound and overcollateralized at all times, and that the fallback stETH withdrawal path is available under normal conditions, while preventing the system from becoming undercollateralized or unsafe.
It’s also important to recognize that the Ethereum validator exit queue represents the ultimate bottleneck. If the network experiences widespread withdrawal congestion, all users will encounter delays until the protocol can process those exits. Our system cannot remove this fundamental constraint, but within the scope of our bridge, it ensures that any delays are minimized and never exceed the unavoidable Ethereum withdrawal process. No additional delays are introduced by our design beyond what the underlying blockchain requires.
Note:
While we’ve put significant thought and care into the Native Yield design, some details might be subject to change as we finalize the implementation ahead of the planned launch in October. We’re sharing this now to give more visibility to the community and open the discussion. We welcome any feedback, questions, or suggestions. Feel free to reply directly in this thread!
OnLinea 