Lidofi CSM bonds determine how much an operator can claim
- last updated
Lidofi’s Community Staking Module (CSM) retains the bond required for an operator’s validator keys before paying claimable rewards. Earned fees can replenish a shortfall, while active penalty locks increase the amount that stays reserved. The bond itself consists of stETH collateral whose balance follows pooled staking accounting. Consequently, accumulated rewards and the amount available to the operator’s rewards address can differ. CSM v3 reward splits can further reduce the operator’s own receipt.
stETH collateral and fee rewards play different roles
The stETH bond backs an operator’s validators, while the Performance Oracle allocates a separate share of protocol fees for eligible validation work. The 0x01 CSM module operates on Ethereum mainnet. The separate 0x02 CSM module operates on Hoodi testnet, with its mainnet launch planned.
The bond belongs to the operator
CSM pools collateral across the validator keys within an operator’s entry. Losses associated with one validator can therefore affect the bond that covers the others. Deposits can use ETH, stETH or wstETH: the module stakes incoming ETH and unwraps incoming wstETH. Its bond accounting ultimately holds stETH shares. Rebases change the token balance represented by those shares, so bond growth follows pooled staking performance. A negative rebase can reduce collateral, even without a penalty against that particular operator.
Fee rewards follow reported performance
Node operator rewards come from the protocol fees assigned to the module. The Performance Oracle assesses validators over a reporting period called a frame. A validator below its applicable performance threshold contributes no operator rewards for that frame. Other eligible validators can still contribute. Bond rebase rewards follow a separate mechanism and don’t depend directly on that validator’s performance.
Why can earned CSM rewards exceed the amount I can claim?
A bond shortfall absorbs available rewards before an operator can claim an excess, and active penalty locks increase the collateral that the contract retains.
Allocated fees must clear the collateral requirement
FeeDistributor holds reward shares and tracks each operator’s cumulative allocation. A valid Merkle proof lets CSM’s Accounting contract pull the difference that hasn’t already been distributed. Previously distributed rewards aren’t available a second time. Once rewards enter the bond, the claim calculation preserves the required collateral. A historical earnings total therefore doesn’t identify the amount currently available for payment.
Before reward splitting, the relationship is the current bond plus undistributed allocated rewards, minus required collateral, with a floor of zero. CSM v3 includes the key-based bond requirement, locked bond and outstanding bond debt in that required amount. The contract calculates in stETH shares; token conversions can introduce rounding. Existing bond growth already appears in the current balance and shouldn’t be added again.
Hypothetical rewards covering a bond shortfall
How much of a new reward remains available when the bond starts below its requirement? In this hypothetical calculation, the current bond is 3.416 stETH, newly allocated operator rewards equal 0.186 stETH and total required collateral equals 3.529 stETH. Assume that requirement already includes any lock, with no bond debt, reward splits or intervening rebase.
Adding the rewards brings the balance to 3.602 stETH. The first 0.113 stETH closes the collateral shortfall, leaving 0.073 stETH as claimable excess before share-rounding effects. The bond can therefore remain sufficient after the operator claims that excess. A smaller reward would reduce the excess. A requirement at or above the available balance would leave nothing claimable.
Key changes alter the collateral that must remain
The bond curve sets collateral requirements from an operator’s remaining key count, including uploaded keys that haven’t received deposits. Adding keys can increase that requirement and consume an existing excess. Removing an undeposited key can reduce the count, although CSM applies its configured key-removal charge. A validator exit requires withdrawal reporting before accounting releases its associated requirement. Independently, penalties or a negative stETH rebase can leave keys underbonded and reduce the amount available to claim.
Penalty locks reserve collateral before settlement
A reported General Delayed Penalty reserves collateral for an assessed protocol violation before settlement determines whether the reserved amount will become a permanent deduction.
A reported lock
Redirecting execution-layer block rewards away from the required Lido rewards vault can trigger this penalty. The reported amount includes the assessed loss and a profile-dependent additional fine. An active penalty lock increases the collateral that CSM’s Accounting contract requires from the operator. At this stage, the contract has reserved the amount without yet deducting it through a settled burn.
Compensation and cancellation
A normal bond top-up increases collateral coverage without canceling the report or clearing its lock. The penalty-compensation operation uses bond collateral to cover the reported amount and reduces the corresponding lock. In CSM v3, the manager can compensate from bond available above the key requirement and debt. That compensation consumes collateral; it doesn’t return the reserved amount to the operator. Cancellation removes the reported reservation without imposing that settled loss. Confirmation through Easy Track instead leads to settlement and a bond deduction.
Settled losses and bond debt
If a settled penalty exceeds available collateral, CSM v3 records the uncovered loss as bond debt. Later bond top-ups and credited fee rewards cover that debt before an excess becomes available. Separately, repeated underperformance can lead to validator ejection and a penalty. One poor-performance frame doesn’t immediately deduct bond collateral. Most validator-specific penalties and exit-related charges settle after withdrawal, when the module can account for the final balance.
Withdrawal reporting releases unused operator collateral
CSM releases a validator’s bond requirement through its withdrawal accounting, which also settles applicable losses and exit-related charges before determining any remaining excess. For an unslashed validator, a withdrawal report establishes the final balance after its full withdrawal. The module applies any shortfall against the confirmed expected balance and settles recorded exit penalties or charges. Slashed validators use a separate committee reporting process because their full loss can require additional assessment. An operator’s remaining keys continue to require collateral, so releasing one key’s requirement doesn’t necessarily make the entire bond claimable.
Signing an exit message doesn’t, by itself, release collateral. Exiting validators also doesn’t clear a separate penalty lock. The validator stake supplied by Lido returns to the protocol. The operator’s claim concerns their remaining bond and rewards, after the module accounts for its requirements.
Operator payouts and reward splits have different recipients
The operator’s rewards address receives its own claimed excess, while CSM v3’s optional splitter routes configured portions of operator fee rewards to separate recipients. The manager, rewards address or an authorized custom claimer can submit the operator’s claim. That permission doesn’t change the destination of its proceeds. The operator can select stETH, wstETH or an ETH withdrawal request for its own payout. Split recipients receive stETH, and the splitter doesn’t divide bond rebase rewards. Any unassigned share of operator fee rewards stays in the bond. The operator’s claim also requires Accounting to be unpaused.
Bond constraints can leave shares awaiting split processing. A raw claimable-bond view can consequently exceed the amount that the operator will personally receive. Pending split transfers need separate accounting before interpreting that view as a payout estimate. Split settings also have update restrictions: initial settings remain fixed until the first rewards distribution, and later changes require clearing unclaimed rewards and pending split shares.
CSM v3’s built-in splitter supports up to 10 additional recipient addresses.
Lidofi: what people ask
Can anyone top up a Lidofi CSM operator’s bond?
Anyone can add bond to an existing CSM operator through the permissionless deposit methods. The contribution credits that operator’s collateral and can cover a shortfall or debt. It doesn’t make the contributor a manager or give them the right to receive the operator’s reward claims.
Must I supply a rewards proof to claim excess CSM bond?
A rewards proof isn’t required when the claim uses only excess bond already held by Accounting. The claim methods allow an empty rewards proof and a zero cumulative-reward value for that purpose. Pulling allocated fee rewards from FeeDistributor requires a valid proof, and the contract counts only shares that haven’t already been distributed.
Will choosing ETH for a CSM claim deliver ETH immediately?
Selecting ETH for a CSM bond or reward claim creates an unstETH withdrawal NFT. Spendable ETH becomes available after the request finalizes and the NFT holder claims it. The transaction reverts if the request falls outside the withdrawal queue’s permitted amount range; an available CSM excess doesn’t override them.
Could a governance change make existing CSM keys underbonded?
Governance can change bond curves and their assignment, which can increase an existing operator’s collateral requirement. A higher requirement can consume an earlier excess or leave keys underbonded. Its effect follows the operator’s assigned curve and remaining key count, so an earlier deposit doesn’t fix the requirement permanently.
What happens if a CSM penalty lock reaches its expiry?
An expired CSM v3 lock can be cleared through Accounting’s unlockExpiredLock function. The lock’s stored expiry determines when that call is valid, and anyone can call it. Clearing the lock removes that reservation, while key collateral requirements, outstanding debt and pending reward splits can still limit the operator’s claim.