Rocket Pool

Summary

Rocket Pool is the longest-running attempt to build a fully permissionless, trust-minimized staking pool for Ethereum. Conceived by Australian developer David Rugendyke in late 2016 — before Ethereum's proof-of-stake chain existed — it ran public betas from 2018 and launched on mainnet in November 2021, shortly after the Beacon Chain went live. Its core innovation is a two-sided marketplace: anyone with a small amount of ETH can mint the liquid staking token rETH, while anyone willing to post a partial ETH bond plus RPL token collateral can run a validator ("minipool") using pooled deposits, without permission or whitelisting. This contrasts with Lido's curated-operator model and made Rocket Pool the reference design for "decentralized" liquid staking. The protocol has grown through successive upgrades (Redstone 2022, Atlas 2023, Houston 2024, Saturn 2024–2026) that progressively cut operator bond requirements from 16 ETH to 8 and then 4 ETH, moved governance on-chain, and reworked RPL tokenomics. By March 2025 the protocol reported roughly 3,900 node operators and over 700,000 ETH staked — consistently the second-largest liquid staking protocol, though an order of magnitude behind Lido.

Design (Mechanism)

• Two-sided pool. Liquid stakers deposit ETH (minimum ~0.01) into a deposit pool and mint rETH, an exchange-rate token whose redemption value against ETH rises as staking rewards accrue (no rebasing). Node operators create minipools by bonding part of a validator's 32 ETH (originally 16, then 8 via Atlas, 4 via Saturn's "megapools") with the remainder assigned from the deposit pool.
• Skin in the game. Operators earn full rewards on their own bond plus a commission on the pooled ETH they run. If a validator is slashed or leaks, losses come out of the operator's bond first — rETH holders are structurally senior. Historically operators also had to stake RPL worth at least 10% of borrowed ETH as supplemental insurance collateral (slashable, auctioned for ETH if the bond is exhausted); Saturn 0 (October 2024) made the RPL bond optional, with RPL staking instead earning a share of ETH commission.
• Upgradeable hub-and-spoke architecture. A single eternal-storage contract, RocketStorage (0x1d8f...Fa46), holds state and contract addresses, letting logic contracts be swapped by governance — the mechanism that has enabled a decade of iteration on immutable rails.
• Oracle DAO (oDAO). A bonded committee of known node operators reports Beacon Chain balances and reward Merkle roots to the execution layer (needed before EIP-4788-style trustless reads). Members post RPL bonds and can be challenged/kicked; Saturn added caps on oDAO penalty power to limit abuse.
• Governance. RPL is the governance token. The Houston upgrade (2024) implemented fully on-chain protocol-DAO voting by staking node operators; RPL inflation funds node-operator rewards, oDAO compensation, and a treasury for grants (IMC/GMC committees).

Outcome

Ongoing and broadly successful as infrastructure, mixed as a token economy. Rocket Pool launched November 2021 (after a last-minute delay to patch a disclosed vulnerability), scaled to hundreds of thousands of ETH across ~3,900 permissionless operators by 2025, and never suffered a protocol-level exploit or loss of user principal. It became the canonical "credibly decentralized" alternative to Lido and influenced Ethereum community thinking on solo-staker economics. However, its market share plateaued around 2–4% of staked ETH — far behind Lido — because capital efficiency for operators was poor (high ETH+RPL requirements) and rETH supply was frequently constrained by operator capacity. RPL token performance decoupled negatively from protocol growth, as the "RPL as mandatory insurance" value-accrual story weakened; this forced the multi-year Saturn tokenomics rework (Saturn 0 in October 2024; Saturn 1 live February 2026 with 4-ETH megapools and a revenue share for staked RPL). A 2023 controversy over an EOA with pDAO parameter powers highlighted that decentralization was aspirational in places; Houston/Saturn addressed it with on-chain governance and oDAO guardrails.

Why it worked

• Aligned collateral hierarchy. Making operator bonds first-loss capital let a permissionless operator set safely manage other people's ETH — no whitelist, no legal agreements, just economics.
• Exchange-rate rETH avoided rebasing complications, making rETH highly composable across DeFi and cleanly tax/accounting-friendly relative to rebasing tokens.
• Patient, security-first shipping (5 years of betas, multiple audits, a delayed launch to fix a reported bug) earned durable community trust; there has been no loss-of-funds incident.
• Upgradeable architecture plus real governance allowed the protocol to repeatedly cut bond sizes and rework tokenomics as ETH staking economics changed.

Limitations and criticisms

• Capital inefficiency constrains growth. Requiring 16 (later 8, now 4 via megapools) ETH plus RPL collateral per validator means operator supply, not staker demand, has historically capped growth; Lido's 0-bond curated model scaled faster and captured stronger network effects (stETH liquidity, integrations), leaving Rocket Pool at a fraction of Lido's market share.
• The mandatory RPL bond created reflexive tokenomics. Operators bought RPL because they had to; when RPL price fell, effective yields and collateral ratios fell with it, deterring new operators — a doom-loop the Saturn rework was explicitly designed to break by making the RPL bond optional.
• The oDAO and residual admin powers (a pDAO parameter EOA surfaced in 2023) were real trust dependencies that sat awkwardly against the decentralization brand until Houston/Saturn narrowed them.
• Complexity tax: the minipool/RPL/commission machinery is much harder to explain and integrate than "deposit ETH, get stETH," which likely still costs it retail mindshare.

Lessons

• A liquid staking protocol is a two-sided market: the binding constraint is usually the operator side, and capital efficiency of the operator bond is the primary growth lever.
• Forcing a governance token into a mandatory-collateral role couples protocol growth to token price and creates reflexive downside; value accrual via revenue share (fee switch) is more robust than value accrual via forced buying.
• First-loss operator bonds are a genuinely effective substitute for whitelisting — Rocket Pool ran thousands of anonymous validators for years with zero principal loss to depositors.
• "Decentralized" claims get audited by rivals: undisclosed admin EOAs and bonded oracle committees will be found and publicized; sunset them proactively.
• Eternal-storage upgradeability (RocketStorage) traded some immutability purity for a decade of survivable iteration — a defensible trade if governance is credible.

Redesign (EDITORIAL — hypothesis, not fact)

This section is editorial speculation. A modern redesign would start where Saturn is heading and go further: drop the bespoke oracle committee entirely in favor of EIP-4788 beacon-root proofs and ZK validator-balance proofs, making rETH's exchange rate trustless. Operator bonds could be made dynamic — priced by a market for validator insurance rather than a fixed 4 ETH — with underwriters (RPL stakers or third parties) selling slashing coverage and earning the commission spread, turning RPL's insurance role into an opt-in priced market instead of a mandate. Distributed validator technology (DVT) squads could let sub-4-ETH participants co-own a bond, pushing permissionless participation toward zero minimums while preserving first-loss collateral. Finally, launching the fee switch at genesis (protocol revenue share to staked RPL) would have avoided five years of reflexive collateral tokenomics.