Skip to content
Mellow logo

Mellow Review

Audit disclosure: dated reports from six firms on one page

of 10

Mellow scores 6.0 in liquid restaking, the plain average of five equally weighted criteria, up from 5.6 after its exit mark was re-scored. A full mark for audit disclosure is held back mainly by fees that each vault sets for itself. Based on primary sources checked on 1 November 2026.

Score arithmetic

(4 + 5 + 6 + 5 + 10) / 5 = 6.0 (was 5.6)

Fees

Deposit, redeem, performance and protocol fees, set per vault, paid in shares

Redemption

Queued, non-cancellable; EarnETH typically about three days, in wstETH

Licence

BUSL-1.1; GPL-2.0-or-later from 30 May 2028 (legacy), 29 Jul 2029 (Core)

Audits

Nethermind, Sherlock, MixBytes (Core); StateMind, ChainSecurity, Decurity earlier

Scores

Commission clarity
4.0
Slashing & risk disclosure
5.0
Exit & redemption
6.0
Licence & code openness
5.0
Audit disclosure
10.0

Each criterion carries equal weight. The overall score is the average of these 5 scores — (4.0 + 5.0 + 6.0 + 5.0 + 10.0) ÷ 5 = 6.0.

Pros

  • Audit disclosure 10/10: dated reports from Nethermind, Sherlock and MixBytes on Core Vaults
  • Earlier architectures carry named reports from StateMind, ChainSecurity and Decurity too
  • Lido Earn risk text names $5 million first-loss capital and says it is not insurance
  • Exit 6/10: EarnETH withdrawals typically take about three days and pay out in wstETH

Cons

  • Commission clarity 4/10: fee types documented, but each vault owner sets the rates
  • Redemption requests cannot be cancelled, and other vaults set their own intervals
  • Pages read do not explain how restaking slashing would reach a vault's share price
  • BUSL-1.1 limits production reuse until 2028 (legacy) and 2029 (Core Vaults)

Mellow is rated in our liquid restaking ratings as vault infrastructure: a curator runs a strategy inside smart-contract vaults and depositors hold vault shares. Its earlier Symbiotic restaking vaults are now documented as legacy, and new deployments use Core Vaults, which list Symbiotic and EigenLayer among several possible venues. The score below grades what Mellow publishes about cost, risk, exit, code and audits. It is desk research from primary sources checked on 1 November 2026, not a hands-on test.

How Mellow scores in liquid restaking

The category uses five criteria, each marked 0 to 10 and weighted equally. The overall score is the plain average: (4 + 5 + 6 + 5 + 10) / 5 = 30 / 5 = 6.0.

Change in this update: exit and redemption rose from 4 to 6 after Mellow's EarnETH documentation began stating a typical withdrawal time (about three days, paid in wstETH), which the earlier review could not find. The overall score moves from 5.6 to 6.0.

CriterionWhat we foundMark
Commission clarityThe FeeManager defines deposit, redeem, performance and time-based protocol fees, all taken in vault shares. Rates are set per vault by its owner; the contract has no default rate and only caps the combined total at 100%.4
Slashing & risk disclosureLido Earn pages name smart contract, market and liquidity risk and describe $5 million of Lido DAO first-loss capital, stated not to be insurance. The pages we read do not describe slashing by restaked networks.5
Exit & redemptionRedemptions run through a queue with a per-vault redeem interval, oracle pricing and curator-supplied liquidity. EarnETH withdrawals typically take about three days. Requests cannot be cancelled.6
Licence & code opennessCode is public on GitHub under the Business Source License 1.1. Legacy restaking code converts to GPL-2.0-or-later on 30 May 2028; the Core Vaults repository on 29 July 2029.5
Audit disclosureThe security page lists reports from Nethermind, Sherlock and MixBytes on Core Vaults (August 2025 to July 2026) and from StateMind, ChainSecurity, Decurity, Sherlock, MixBytes and Nethermind on earlier architectures.10

Strongest criterion: audit disclosure

Audit disclosure is the only full mark. Mellow's security page lists more than a dozen dated Nethermind reports on Core Vaults, from August 2025 to June 2026, plus a Sherlock public contest (August 2025) and a MixBytes review of the SyncRedeemQueue (July 2026). The legacy MultiVault, Simple LRT and interoperable vault code each have named reports from at least two firms. Every report is linked from one page, so a reader can match a deployed architecture to the reviews that covered it.

This mark rewards disclosure, not safety. An audit is a review of code at a point in time; it is not insurance, and it says nothing about how a curator uses the permissions the code grants. Lido Earn adds a Sherlock bug bounty of up to 100,000 USDC, which sits outside this criterion.

Weakest criterion: commission clarity (4)

This is a deficiency, not a gap in our research. Mellow documents the fee structure in detail but does not publish a fee level, because there isn't one: each vault's owner chooses the rates. For Lido EarnETH, Lido sets the fees and shows them only in its own interface. The EarnETH documentation page gives no figures. A depositor has to check each vault before depositing, and the mark reflects that the protocol itself discloses mechanics rather than costs. Our guide to staking returns after costs shows why stacked fees matter.

Middle marks: exit, risk disclosure and licence

Exit & redemption (6). The RedeemQueue locks shares when a request is made, waits for a vault-specific redeem interval, prices the request at the next oracle report, then pays out once the curator or a keeper has pulled enough liquidity. Requests cannot be cancelled, which Mellow says stops users from forcing a curator to unwind and then backing out. The contract documentation gives no fixed interval and no redeem fee figure. Product pages now give typical times: EarnETH withdrawals "typically take about three days" and pay out in wstETH. That published figure is what lifted the mark to 6, the level the category gives other entries with a stated but liquidity-dependent exit. It is a typical time, not a guarantee, and it covers one product; other vaults set their own intervals.

Slashing & risk disclosure (5). Lido Earn states that strategies carry smart contract, market and liquidity risk, that returns are not guaranteed, and that $3 million in wstETH and $2 million in USDC of Lido DAO first-loss capital is burned first in a confirmed loss. Vault roles sit with multisig safes, and Lido and Mellow each hold a pauser role. What is missing is slashing: the pages we read do not say how a slashing event on Symbiotic or EigenLayer would reach a vault's share price.

Licence & code openness (5). The source is readable and public, which earns the middle of the scale. Business Source License 1.1 limits production reuse until each change date, and both licences name G3M Labs S.A. as licensor.

What the score does not cover

  • Yield. Returns depend on the curator's strategy and are not graded.
  • Individual vault fees. We grade what Mellow publishes, not the rates in any one vault.
  • Curator quality. Mellow's terms describe curators as separate actors; their decisions are outside this rating.
  • Access. The terms exclude the United States and other listed jurisdictions. Availability does not enter the score.

Mellow vs the closest rated peers

ServiceOverall score
Renzo (ezETH)7.6
ether.fi (eETH / weETH)7.2
YieldNest (ynETH)6.8
EigenLayer6.6
Symbiotic6.6
Mellow6.0
Kelp DAO (rsETH)5.4

Scores are as published on 1 November 2026. Mellow is sixth of nine: 0.6 points behind EigenLayer and Symbiotic, the restaking layer behind its legacy vaults, and 0.6 ahead of Kelp DAO. Most of the 1.6-point gap to Renzo comes from commission clarity, where Renzo publishes one fee split and Mellow leaves rates to each vault.

Who this rating suits

The score is most useful to readers who weigh audit coverage heavily and are prepared to read each vault's fees and queue terms themselves. It is a weaker fit for anyone who wants one published fee or a clear statement of slashing exposure before depositing. It is not a recommendation to deposit; how scores are built is set out in our methodology.

How it compares

Sources

Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.

  1. 1.Mellow docs: security and audits — checked
  2. 2.Mellow docs: FeeManager — checked
  3. 3.Mellow docs: RedeemQueue — checked
  4. 4.Mellow docs: Lido Earn overview — checked
  5. 5.Mellow docs: EarnETH — checked
  6. 6.Mellow docs: vault infrastructure overview — checked
  7. 7.Mellow: mellow-lrt LICENSE (BUSL-1.1) — checked
  8. 8.Mellow: flexible-vaults (Core Vaults) LICENSE — checked
  9. 9.Mellow: terms of service v2.1 — checked

Frequently asked questions

Why does Mellow score 6.0?

It is the plain average of five equally weighted marks: 4 for commission clarity, 5 for slashing and risk disclosure, 6 for exit and redemption, 5 for licence and code openness and 10 for audit disclosure. The total of 30 divided by five gives 6.0.

What changed since the previous score?

Exit and redemption rose from 4 to 6, lifting the overall score from 5.6 to 6.0. Mellow's EarnETH page now states that withdrawals typically take about three days and pay out in wstETH; the earlier review found no stated period.

What holds Mellow's score back?

Mainly commission clarity, at 4. Mellow publishes how its four fee types work but leaves the rates to each vault's owner, so there is no single fee to read. Slashing disclosure and the source-available licence sit at 5.

Was Mellow tested hands-on?

No. The rating is desk research from Mellow's documentation, terms, security page and public GitHub repositories, checked on 1 November 2026. No deposits or withdrawals were made.

How does Mellow compare with ether.fi and Symbiotic?

Mellow scores 6.0, behind Symbiotic at 6.6 and ether.fi at 7.2. Renzo leads the category at 7.6.

Who is Mellow's rating most useful for?

Readers who put audit coverage first and are willing to check each vault's fee settings before depositing. Readers who need a single published fee will find less support in the documentation.

Nothing here is financial advice. Editorial policy · How we score · How we're funded.