TL;DR verdict
Bedrock uniBTC is a multi-asset liquid restaking protocol launched in 2023 with roughly $0.3B TVL and two audits (SlowMist, Salus). It is not incident-free: in September 2024 a flaw in the uniBTC mint function was exploited for about $2M. It integrates with restaking layers (Babylon, EigenLayer EigenLayer, Symbiotic), from which it also inherits slashing and smart-contract risk.
- Exploited for ~$2M in September 2024 via an infinite-mint flaw in the uniBTC mint function (contract patched, reimbursement announced).
- Audited by SlowMist (code review) and Salus (economic security).
- Governed by the Bedrock DAO, with token BR.
Audit history
Bedrock uniBTC has been audited by two security firms:
- SlowMist: Focused on code logic and vulnerability detection. Exact audit date and number of findings are not publicly disclosed.
- Salus: Provided a review of economic security and incentive alignment. No detailed report is available.
The protocol has not made full audit reports publicly viewable, which limits independent assessment of residual risks. The contracts are deployed on Ethereum and multiple L2s; upgrade mechanisms, if any, are not documented.
Incidents and exploits
Bedrock uniBTC suffered a smart-contract exploit in September 2024. The mint function that converted deposits into uniBTC failed to account for the price differential between assets, so an attacker could deposit a small amount of native ETH and mint a disproportionate quantity of uniBTC — effectively an infinite-mint vulnerability. The attacker minted uniBTC and swapped it for WBTC through a Uniswap pool, netting roughly $2M and draining the uniBTC liquidity pool at the expense of LPs. On 27 September 2024 Bedrock acknowledged the incident, said remaining funds were secure, patched the contract, and committed to a reimbursement plan and post-mortem. A security firm (Fuzzland) later attributed the exploit to a former employee (an insider vector). No further major incidents have been recorded since.
Smart contract risks
The codebase is approximately three years old and spans six chains (Ethereum, Arbitrum, BNB, Optimism, Base, Mantle). While no critical bugs have surfaced, the absence of published audit reports limits independent verification. Bedrock DAO governance controls parameters and upgrades, but the multisig structure and timelock details are not transparent. uniBTC relies on oracles to track restaking yields across Babylon, EigenLayer EigenLayer, and Symbiotic; a malfunction could lead to minting errors or depegging. The composability with multiple restaking layers compounds risk—a vulnerability in any underlying protocol could affect uniBTC positions.
Operational and counterparty risks
The team is anchored by RockX, a reputable blockchain infrastructure provider, but additional core contributors are not named. Regulatory exposure is moderate; liquid restaking tokens may face scrutiny similar to LSDs in the US and EU. No insurance coverage or safety fund is publicly announced. Key dependencies are the uptime and security of Babylon, EigenLayer EigenLayer, and Symbiotic; a failure in any could lead to slashing or redemption delays.
How to use it more safely
- Use a hardware wallet for all restaking positions.
- Monitor Bedrock DAO governance proposals regularly for upgrade risks.
- Diversify restaking across multiple LRTs (e.g., Renzo Renzo, EigenLayer EigenLayer) to limit single-point exposure.
- Keep position size small relative to your overall portfolio; LRTs are still experimental.
- Verify peg stability of uniBTC against BTC on-chain before entering or exiting.
- Review the protocol’s GitHub for any recent code changes or unaudited updates.
Verdict
Bedrock uniBTC is backed by two audits and integration with major restaking protocols, but its record is not clean: the September 2024 infinite-mint exploit (~$2M) revealed a serious flaw that audits did not catch, and a security firm attributed it to an insider. Combined with the lack of transparent audit reports, undocumented upgrade paths, and dependence on multiple external protocols, this warrants caution. We assign a safety score of 6.5 out of 10.
DeFi Intel publishes editorial research, not financial advice. Smart contract risk is never zero. Do your own research and consider position sizing accordingly.