EigenLayerVerifier

Overview

EigenLayerVerifier is a custom ICustomVerifier implementation tailored to securely authorize calls to EigenLayer contracts like DelegationManager, StrategyManager, and RewardsCoordinator. It uses strict role-based gating, exact calldata matching, and entity-specific validation to ensure that only authorized vaults and bots can interact with EigenLayer staking, delegation, withdrawal, and rewards workflows.

Purpose

This verifier protects EigenLayer operations by:

Ensuring only whitelisted entities (vaults, strategies, operators) can execute actions
Verifying target contracts and function selectors precisely
Enforcing exact calldata encoding to eliminate any ambiguity or abuse

Role Definitions

Role Constant	Description
`CALLER_ROLE`	Address allowed to initiate EigenLayer calls (typically curators)
`ASSET_ROLE`	Whitelisted ERC20 token allowed in strategy deposits or withdrawals
`STRATEGY_ROLE`	Whitelisted EigenLayer strategy contracts
`OPERATOR_ROLE`	Approved EigenLayer operator address for delegation
`MELLOW_VAULT_ROLE`	Whitelisted vaults acting as stakers or earners (usually `Subvault` )
`RECEIVER_ROLE`	Authorized receivers for claimed rewards

Constructor

constructor(address delegationManager_, address strategyManager_, address rewardsCoordinator_, string memory name_, uint256 version_)

Initializes the verifier by:

Setting immutable references to EigenLayer’s:
- DelegationManager
- StrategyManager
- RewardsCoordinator
Inheriting access control via OwnedCustomVerifier

`verifyCall`

function verifyCall(
    address who,
    address where,
    uint256 value,
    bytes calldata callData,
    bytes calldata /* verificationData */
) external view override returns (bool)

General Preconditions

who must have CALLER_ROLE
value must be 0 (no ETH allowed)
callData.length >= 4 (valid selector)

Validated Targets & Selectors

1. StrategyManager – `depositIntoStrategy`

depositIntoStrategy(IStrategy, address asset, uint256 shares)
- Strategy must have STRATEGY_ROLE
- Asset must have ASSET_ROLE
- Shares must be non-zero
- Calldata must match

2. DelegationManager

delegateTo(address operator, SignatureWithExpiry signature, bytes32 salt)
- Operator must have OPERATOR_ROLE
- Calldata must match
queueWithdrawals(QueuedWithdrawalParams[] params)
- Only one params.length == 1 allowed
- Param must include:
  - One strategy with STRATEGY_ROLE
  - One deposit share > 0
- Calldata must match
completeQueuedWithdrawal(Withdrawal, address[] tokens, bool receiveAsTokens)
- receiveAsTokens must be true
- Withdrawal must:
  - Have only one strategy with STRATEGY_ROLE
  - Have staker with MELLOW_VAULT_ROLE
- tokens.length == 1 and token must have ASSET_ROLE
- Calldata must match

3. RewardsCoordinator – `processClaim`

Selector: processClaim(RewardsMerkleClaim claimData, address receiver)
Checks:
- claimData.earnerLeaf.earner must have MELLOW_VAULT_ROLE
- receiver must have RECEIVER_ROLE
- Calldata must match

Security Properties

Role enforcement: Prevents unauthorized usage of EigenLayer functions
Exact calldata match: Avoids incorrect encoding or maliciously crafted data
Zero ETH transfers: Disallows unexpected native token usage
Single param enforcement (withdrawals): Minimizes complexity and risk surface

​Overview

​Purpose

​Role Definitions

​Constructor

​verifyCall

​General Preconditions

​Validated Targets & Selectors

​1. StrategyManager – depositIntoStrategy

​2. DelegationManager

​3. RewardsCoordinator – processClaim

​Security Properties