Liquid Staking Risks Explained

By the Guardian team Updated November 2026 6 min read

Quick answer. Liquid staking tokens like stETH and JitoSOL carry six main risks: contract bugs, slashing, trading below their backing, slow withdrawals, concentrated validators and admin keys. Used as DeFi collateral, they also add oracle and liquidation risk.

Watch: Liquid Staking Risks Explained 1:36

Video transcript

Liquid staking tokens like stETH and JitoSOL make staked assets tradable. That liquidity is where much of the risk sits.

There are six main risks: contract bugs, slashing, trading below backing, slow withdrawals, concentrated validators and admin keys. As DeFi collateral, they add oracle risk too.

Slashing gets dangerous when one operator fails across many validators at once. Penalties scale with correlated stake, up to the full balance.

In June 2022, before Ethereum allowed staking withdrawals, stETH hit a record 8 percent discount, and Curve's pool ran short of ETH.

Whoever can upgrade or mint controls the claims. Lido routes changes through a vote and a four day delay. Liquid Collective and mETH multisigs can act with no delay.

Withdrawals take time too. Lido's queue has no fixed timetable, and requests cannot be canceled.

In March 2026, an oracle cap priced wstETH below its exchange rate on Aave. Chaos Labs counted about 26 million dollars of liquidations, and no bad debt.

So map your exposure, track the discount, check the exit, read the keys, know the oracle, and alert on changes the day they land.

Guardian's Risk Monitoring tracks who can upgrade, pause or mint, and flags changes as they land. Read the full article, or talk to Guardian.

A liquid staking token (LST) is a tradable receipt for staked assets. Lido issues stETH on Ethereum; Jito issues JitoSOL on Solana.

DefiLlama ranked Lido first by Ethereum TVL on November 4, 2026, at $23.6 billion, per our admin key census.

Liquidity is what makes an LST useful, and it is where much of the risk sits. For the legal side, see our post on the SEC's liquid staking guidance.

How Liquid Staking Works

You deposit ETH or SOL. The protocol stakes it with validator operators and issues you a token.

To get your assets back, you sell the token or redeem it through the protocol's withdrawal queue. Each step carries a risk:

Risk	What can go wrong	Example
Smart contract	A bug or malicious upgrade mints or locks tokens	Ankr aBNBc, December 2022
Slashing	Validators are penalized and backing falls	Lido: up to 100% at risk if validators fail
Depeg	The token trades below its backing	stETH, record 8% discount, June 2022
Withdrawal queue	Redemption takes days, or is paused	Lido queue; Ethereum exit queue
Concentration	One protocol or few operators hold much of the stake	Lido: 21.18% of staked ETH (H1 2026)
Admin keys	Someone can upgrade, pause or mint	Liquid Collective: 4-of-7 Safe, no delay
Integration	A lender misprices or over-trusts the token	Aave's wstETH oracle, March 2026

Smart Contract and Key Risk

An LST contract mints claims on staked assets. Whoever can mint or upgrade it controls those claims.

In December 2022, an attacker compromised Ankr's BSC deployer key and upgraded the aBNBc token. Rekt reports it then minted 60 trillion aBNBc.

Thin liquidity capped the attacker at about $5M. Another user borrowed 16M HAY on Helio against the crashed token, "before the oracle had updated."

Lido's integration guide says smart contract risk remains despite audits and a bug bounty.

Who holds the keys

Three staking protocols from our admin key census:

Lido: an LDO vote through Dual Governance, then 4 days, which stETH holders can extend.
Liquid Collective: a 4-of-7 Safe can upgrade River, the LsETH contract, with no delay.
mETH: a 6-of-14 Safe holds forceMint and forceBurn on any account, with no delay.

Lido's withdrawal pause sits with a 3-of-6 Safe and is single use, the census found.

Slashing and Validator Risk

Ethereum slashes validators that sign two blocks for the same slot, or cast conflicting attestations.

The first penalty is small: 0.0078125 ETH for a 32 ETH validator. The validator is then forced out over 36 days.

Halfway through, a correlation penalty scales with how much stake was slashed around the same time. Per ethereum.org, "the maximum slash is the full effective balance of all slashed validators."

So the danger is one operator failing across many validators at once. Lido's guide warns of "up to 100% of staked funds at risk if validators fail."

It also notes that Lido's daily rebases "have never been negative by the time of writing."

Slashing logic can also fail in code. In a Guardian review of Valantis' stHYPE contracts, minting could go ahead while a slash was pending, shifting the loss to new minters (High).

On Solana, Jito's FAQ says slashing "currently doesn't exist on Solana." It still names "massive validator slashing" and "critical smart contract bugs" as ways JitoSOL could lose value.

Concentration

Lido's H1 2026 report put its share of staked ETH at 21.18%, down from 23.93% at the start of the year.

JitoSOL's StakeNet picks the top 400 validators by performance, fees and reliability, automatically every 20 to 30 days.

Depeg and Withdrawal Risk

An LST can trade below the assets behind it. Lido's guide warns that users "risk an exchange price of stTokens which is lower than inherent value due to withdrawal restrictions."

stETH in June 2022

Ethereum staking withdrawals arrived with the Shapella upgrade on April 12, 2023. In 2022, an stETH holder who wanted ETH had to find a buyer.

CoinDesk reported the discount hit a record 8% on June 13, 2022, citing Dune data.

By June 16, Curve's stETH pool held about 111,000 ETH against 492,000 stETH. In CoinDesk's words, there was "simply not enough tokens to swap stETH into."

Withdrawal queues today

Lido now redeems stETH for ETH, but on no fixed timetable. Its docs set these terms:

A request "cannot be canceled," and earns no rewards while queued.
It finalizes only when an oracle report finds enough ETH.
A pause can halt new requests and finalization.
After a massive Beacon Chain loss, it can finalize below 1:1.

Behind any Ethereum protocol's queue sits the network's exit queue. Ethereum.org says exiting "takes variable amounts of time, depending on how many others are exiting at the same time."

When we checked validatorqueue.com on November 5, 2026, the exit wait was about one day, plus a sweep delay of about seven days.

JitoSOL's direct unstake waits up to one epoch, about two days, with a 0.1% fee. Selling on a DEX is instant, at the market price.

LSTs as DeFi Collateral

Lenders accept LSTs as collateral, so a problem with the token becomes the lender's problem.

Oracles come first. In March 2026, a cap in Aave's CAPO oracle priced wstETH about 2.85% below its exchange rate.

Chaos Labs' post-mortem counted about $26M of liquidations across 34 accounts, and no bad debt.

Hardcoded prices are another trap. In Rest Finance's EigenLayer LST vault, Guardian found stETH priced at a fixed 1 ETH (High).

Liquid restaking adds bridges. In April 2026, stolen rsETH became collateral for 82,650 WETH on Aave, as our Aave safety guide explains.

Lido's guide says "robust price sources are required for listing on most money markets."

If you lend through a curated vault, the curator decides which LST markets you fund. See vault curator risk.

How to Monitor LST Exposure

Map exposure. Every LST and wrapper you hold, directly or through vaults and lenders.
Track the discount. Market price against redemption rate, and depth in the main pools.
Check the exit. The protocol queue, Ethereum's exit queue, and who can pause withdrawals.
Read the keys. Who can upgrade, pause or mint, and the delay on each.
Watch operators. Operator count, stake split and any slashing event.
Know the oracle. Market price or exchange rate, any caps, and staleness limits.
Size to the stress exit. Plan on the exit you could get in a bad week.
Alert on changes. Upgrades, role grants and oracle swaps, the day they land.

How Guardian Helps

For LST issuers, Guardian's Risk Monitoring tracks every deployed address and who holds owner, pauser, upgrader and parameter rights.

It compares timelocks, thresholds, pause state, fee and risk parameters, and oracle sources against the reviewed configuration. Upgrades surface as they land.

For holders and allocators, Guardian's risk ratings score each position from 0 to 100 and keep watching for upgrades, signer changes and swapped oracles.

Frequently Asked Questions

What are the main risks of liquid staking tokens?

Smart contract bugs, slashing, trading below backing, slow withdrawals, concentrated operators and admin keys. Used as DeFi collateral, LSTs add oracle and liquidation risk too.

Can stETH lose its peg to ETH?

It can trade below ETH. CoinDesk reported a record 8% discount in June 2022, before Ethereum allowed staking withdrawals. Lido's queue now redeems stETH for ETH, normally one to one, but it takes time.

Is there slashing on Solana?

Jito's FAQ says slashing "currently doesn't exist on Solana." JitoSOL still carries smart contract, validator and liquidity risk, and a direct unstake waits up to one epoch, about two days.

How long do Lido withdrawals take?

There is no fixed time. Requests finalize through oracle reports once enough ETH is available, and Ethereum's exit queue varies with demand. Requests cannot be canceled, and rewards stop while you wait.

Sources

Watch the keys behind your staking tokens

Guardian tracks upgrades, role changes and oracle swaps at the contracts you depend on, and flags them the day they land.

Talk to Guardian Explore Risk Monitoring