Shared security is a liability. Protocols like Cosmos Hub and Polkadot centralize economic risk by pooling validator stakes, which regulators view as a unified, targetable entity rather than a collection of independent chains.
layer-2-wars-arbitrum-optimism-base-and-beyond
Blog
Why Shared Security Attracts Regulatory Scrutiny
The Superchain thesis centralizes security provision, creating a single, identifiable entity that fits the SEC's enforcement playbook. This analysis examines the legal risks for Optimism's OP Stack, Arbitrum Orbit, and Coinbase's Base.
introduction
THE REGULATORY LENS
Introduction
Shared security models, while technically elegant, create a single point of regulatory failure for entire ecosystems.
The legal wrapper is undefined. A restaking pool on EigenLayer or a rollup sequencer set secured by Ethereum does not fit cleanly into existing securities or banking law, forcing regulators to apply the broadest, most restrictive interpretations.
Evidence: The SEC's case against Lido and Rocket Pool staking services establishes precedent that pooled, yield-generating crypto assets are investment contracts, a framework directly applicable to shared security providers.
thesis-statement
THE REGULATORY TRAP
The Core Argument: Centralized Security is a Legal Liability
Shared security models create a centralized point of failure that regulators will target as a securities issuer.
Shared security is a securities offering. When a protocol like EigenLayer or Babylon pools capital to secure external systems, it creates a common enterprise with an expectation of profit derived from others' efforts—the Howey Test's core criteria.
The liability is non-delegable. A court will hold the protocol's core developers liable for downstream failures, not the individual stakers, creating an existential legal risk that invalidates the decentralization narrative.
Compare this to Uniswap's legal shield. Its immutable core contracts and lack of a profit-promising token model have withstood SEC scrutiny, while a security-slash-slashing model like EigenLayer's invites it.
Evidence: The SEC's case against LBRY established that even decentralized-appearing projects with active core teams are vulnerable. A shared security pool managed by a foundation is a clearer target.
key-trends
WHY SHARED SECURITY ATTRACTS REGULATORY SCRUTINY
The Superchain Security Landscape: Three Models, One Risk
Shared security models create powerful network effects but concentrate legal liability, making them prime targets for regulators like the SEC.
01
The Problem: Shared Sequencers Create a Single Point of Legal Failure
A shared sequencer like Espresso or Astria provides atomic cross-rollup composability and liveness guarantees. However, it centralizes transaction ordering power, creating a clear legal entity that can be targeted.\n- Legal Entity: A defined company operates the service, unlike decentralized validator sets.\n- Control Point: It has final say on MEV extraction and transaction censorship, attracting financial regulator attention.\n- Precedent: The SEC's case against LBRY and Uniswap Labs establishes that providing critical, centralized infrastructure can imply control.
1 Entity
Legal Target
100%
Tx Control
02
The Problem: Native Staking Pools Are De Facto Security Issuers
Superchains like Optimism's OP Stack use a native token (OP) to secure a network of chains via restaking or direct delegation. This model incentivizes alignment but mirrors the economics of a security.\n- Profit Expectation: Stakers earn fees from all chains in the ecosystem, a direct cash flow from a common enterprise.\n- Horizontal Integration: The success of individual L2s (Base, Zora) directly boosts the staking token's value.\n- Howey Test Risk: The SEC's case against Coinbase Staking targeted precisely this: earning rewards from a centralized entity's efforts.
$10B+
Ecosystem TVL
SEC v. Coinbase
Legal Precedent
03
The Solution: Ethereum L1 as the Ultimate Legal Heat Sink
The only defensible model is maximal decentralization, using Ethereum's base layer for consensus and settlement. L2s become pure execution clients, outsourcing legal risk.\n- No Native Token: Security derives from ETH staking, a sufficiently decentralized asset with established regulatory treatment.\n- No Centralized Sequencer: Rely on decentralized validator sets or permissionless proof-of-stake.\n- Regulatory Arbitrage: Follow the Bitcoin playbook: be a protocol, not a platform. The SEC's reluctance to pursue ETH as a security is the precedent.
~1M
Validators
0 Legal
Control Points
SECURITY-AS-A-SERVICE
Regulatory Risk Matrix: Comparing Shared Security Models
A first-principles comparison of how different shared security models attract regulatory scrutiny based on legal classification, control, and economic dependency.
| Regulatory Dimension | Rollups (Ethereum L2s) | Restaking (EigenLayer) | Cosmos Hub (Replicated Security) | Polkadot (Parachains) |
|---|---|---|---|---|
Primary Legal Classification Risk | Technology Service | Investment Contract (High Risk) | Technology Service | Security (High Risk) |
Centralized Sequencer Control | ||||
Native Token Required for Security | ||||
Direct Slashing of User Assets | ||||
AVS/Parachain Failure Cascades to Hub | ||||
Regulatory Precedent (SEC Actions) | None | Pending (Similar to staking services) | None | Explicitly cited in SEC vs. Coinbase |
% of Total Value Secured by Parent Chain |
| 100% | 100% | 100% |
Key Regulatory Entity | CFTC (Commodity) | SEC | Unclear | SEC |
deep-dive
THE REGULATORY TRAP
The Slippery Slope: From Technical Service to Security
Shared security models inherently create financial dependencies that regulators classify as investment contracts.
Protocols become securities when their core value proposition shifts from pure utility to profit-sharing. The Howey Test focuses on investment of money in a common enterprise with an expectation of profits from others' efforts. Staking rewards derived from sequencer fees or MEV capture transform a technical service into a passive income stream, creating a clear regulatory target.
Restaking amplifies this risk. EigenLayer's model bundles cryptoeconomic security from Ethereum validators and sells it to Actively Validated Services (AVSs). This creates a financial derivative where AVS rewards are the 'profit' and the protocol's success depends on EigenLayer's managerial efforts. This structure mirrors a traditional investment contract more than a simple cloud computing service.
The SEC's actions against Coinbase staking and Kraken's settlement establish precedent. Regulators view delegated staking services where the provider controls key generation and slashing as unregistered securities offerings. Shared security protocols that abstract user involvement into a tokenized yield product will face identical scrutiny.
Evidence: The SEC's 2023 Wells Notice to Coinbase explicitly cited its staking program as an unregistered security, arguing users relinquish control and expect profits from Coinbase's entrepreneurial efforts—a blueprint for action against restaking pools and shared sequencer networks.
counter-argument
THE REGULATORY SHIELD
The Bull Case: Decentralization as a Defense
Shared security models like restaking and modular execution layers create a legally defensible architecture by distributing control and eliminating single points of failure.
Regulators target centralized control. The SEC's actions against Coinbase and Kraken establish a precedent: custody, order-matching, and profit-taking define a security. EigenLayer's restaking model diffuses these functions across thousands of independent node operators, creating a system with no single liable entity.
Modular execution layers are legally inert. A rollup like Arbitrum or Optimism is just a deterministic state transition function. Its security and data availability are outsourced to a decentralized base layer (Ethereum) or a network of validators (Celestia, EigenDA). The execution layer itself holds no value and exercises no discretion.
Contrast this with monolithic app-chains. A chain like Solana or a Cosmos app-chain with a small validator set centralizes legal risk. Its foundation, core developers, and top validators become de facto control points. Shared security is a liability firewall.
Evidence: The Howey Test's 'common enterprise' prong fails when node operators are permissionless, anonymous, and economically independent. This is the core argument protocols like EigenLayer and AltLayer present to regulators.
risk-analysis
WHY SHARED SECURITY ATTRACTS SCRUTINY
The Bear Case: Potential Regulatory Triggers
Shared security models, while technically elegant, create novel legal liabilities by pooling risk and control across protocols.
01
The Howey Test for Staked Tokens
Regulators view pooled staking as a common enterprise with an expectation of profit from the efforts of others. Restaking amplifies this risk by layering multiple yield streams onto a single asset, creating a clear investment contract profile.
- Key Trigger: $50B+ in restaked assets across EigenLayer, Babylon.
- Legal Precedent: SEC's actions against Lido and Kraken staking services.
$50B+
At Risk TVL
2x
Liability Layers
02
The Unlicensed Money Transmitter
Cross-chain messaging and shared sequencers facilitate asset movement. If a hub like EigenLayer or Cosmos is deemed the central operator of a "money transmission network", every AVS and chain inherits its regulatory status.
- Key Trigger: OFAC-sanctioned transactions routed through a shared security layer.
- Systemic Risk: One protocol's compliance failure implicates hundreds.
100+
Linked Chains
OFAC
Primary Risk
03
Centralization of Failure Points
Shared security intentionally creates a few critical, trusted components (e.g., EigenLayer Operators, Cosmos Validator Sets). This creates a target-rich environment for regulators, who can achieve "regulation-by-enforcement" against a handful of entities to control the entire ecosystem.
- Key Trigger: SEC subpoenas to top 5 operator sets.
- Network Effect: A 20% operator shutdown could freeze $10B+ in DeFi.
20%
Critical Mass
$10B+
DeFi Frozen
04
The Unregistered Securities Exchange
Actively Validated Services (AVSs) that perform order matching or liquidity provisioning (e.g., a shared sequencer for rollups) could be classified as an exchange. The shared security pool becomes the de facto clearinghouse, liable for all transactions it secures.
- Key Trigger: An AVS offering MEV smoothing or cross-chain DEX aggregation.
- Precedent: Uniswap Labs receiving Wells Notice for operating as an unregistered exchange.
AVS
New Attack Vector
SEC
Enforcement Focus
future-outlook
THE REGULATORY FRONTIER
The Path Forward: Mitigation or Enforcement?
Shared security models, particularly restaking, create systemic risks that regulators will treat as unlicensed financial services.
Shared security is a liability. Protocols like EigenLayer and Babylon commoditize Ethereum's validator set, creating a systemic risk vector that regulators will target. The SEC's focus on 'investment contracts' means pooled capital for yield generation is a primary enforcement trigger.
The enforcement target is the orchestrator. Regulators will pursue the protocol core team, not individual node operators. This mirrors actions against centralized crypto lenders like Celsius, where the platform's design constituted the unregistered security.
Mitigation requires architectural change. True decentralization via permissionless operator sets and non-custodial slashing is the only defense. Projects must prove no single entity controls the pooled capital or its allocation.
Evidence: The SEC's case against Lido/Rocket Pool staking services establishes precedent. Their argument hinges on the marketing of yield from a common enterprise, a framework that fits restaking pools directly.
takeaways
REGULATORY RISK ANALYSIS
TL;DR for CTOs and Architects
Shared security models like restaking and interchain security create novel, systemic risks that regulators are now actively mapping to existing frameworks.
01
The Legal Entity Problem
Protocols like EigenLayer and Cosmos Hub abstract security from a single legal entity. Regulators (e.g., SEC) need a responsible party. The 'decentralized' provider of a critical service becomes an unregistered, unlicensed financial utility.
- Risk: Enforcement actions target the point of centralization (e.g., foundation, core devs).
- Precedent: Howey Test application focuses on the expectation of profit from a common enterprise.
$18B+
EigenLayer TVL
40+
Active AVSs
02
The Systemic Contagion Vector
Shared security creates a tight coupling risk. A failure or slashing event in one application (e.g., an EigenLayer AVS or Cosmos consumer chain) can cascade, threatening the economic security of the entire ecosystem.
- Risk: Classified as a systemic risk to financial stability, inviting FSB and CFTC scrutiny.
- Example: A bug in an oracle AVS could simultaneously destabilize dozens of dependent DeFi protocols.
100x
Leverage Risk
1→N
Failure Domain
03
The Compliance Black Box
Validators in shared pools (e.g., Ethereum stakers restaking via EigenLayer) cannot audit every Actively Validated Service (AVS). This creates a liability gap for regulated entities (e.g., Coinbase, Kraken) who must comply with AML/KYC and sanctions laws.
- Risk: Staking-as-a-service providers may be forced to exit shared pools, fragmenting security.
- Challenge: Enforcing geographic restrictions or entity blacklists becomes technically impossible.
0%
Validator Oversight
High
Sanctions Risk
04
Solution: Sovereignty with Security Leasing
The counter-trend: Celestia-inspired rollups and Ethereum L2s (via EigenDA) lease data availability and consensus without leasing full-state execution security. This limits liability scope.
- Benefit: Appchain maintains its legal/technical sovereignty.
- Trade-off: Security is modular and non-custodial, reducing regulator's 'common enterprise' argument.
Modular
Architecture
Reduced
Legal Surface
05
Solution: Explicit, Isolated Security Pools
Instead of a monolithic pool (e.g., all Ethereum stakers), projects like Babylon offer Bitcoin staking for specific, permissioned chains. Security is dedicated and contractually defined.
- Benefit: Clear legal boundaries and risk isolation. No uncontrolled cross-contagion.
- Trade-off: Lower capital efficiency and liquidity versus a global pool like EigenLayer.
Isolated
Risk Pool
Contractual
Clarity
06
The Regulatory Arbitrage Endgame
Jurisdictions like the UAE and Singapore will craft bespoke frameworks for shared security, attracting protocols. The EU's MiCA will treat staking-as-a-service as a regulated activity, forcing fragmentation.
- Action: Architect for jurisdictional plug-ins and sovereign compliance modules.
- Forecast: A balkanized landscape of regulated and permissionless security markets emerges by 2026.
MiCA
2024 Live
Balkanized
Market Outcome
ENQUIRY
Get In Touch
today.
Our experts will offer a free quote and a 30min call to discuss your project.
NDA Protected
Confidentiality24h Response
Time to ValueDirectly to Engineering Team
No Sales Fluff10+
Protocols Shipped
$20M+
TVL Overall