Skip to content
Quantix Security Labs

Helion Protocol

Liquid staking with a permissioned node-operator set.

Users deposit ETH and receive a rebasing liquid staking token. Deposits are batched into validators run by approved node operators; an oracle committee reports beacon-chain balances that drive rebases and withdrawals.

Ecosystem
ETHEthereum
Category
Liquid Staking
Languages
Solidity
Launched
Apr 2025
87.7AALow risk

Grade AA · Low risk

Strong posture with minor, documented weaknesses.

+3.0 since Nov 2025 · ±0.0 since Jul 2026

Quantix Protocol Research · as of 24 Oct 2026 · About this data

Risk Index

How the score is built

Six weighted components, each scored 0–100 where higher means less risk. Points are the component value multiplied by its weight; the gap is what the component costs against a perfect score.
ComponentWeightValuePointsGap
Code Security30%9027.0−3.0
Operational Security20%8817.6−2.4
Governance Risk15%8412.6−2.4
Economic Security15%8612.9−2.1
Infrastructure Resilience10%868.6−1.4
Transparency10%909.0−1.0
Quantix Risk Index100%87.7−12.3
CodeOperationalGovernanceEconomicInfrastructureTransparencyHelion Protocol, Code: 90Helion Protocol, Operational: 88Helion Protocol, Governance: 84Helion Protocol, Economic: 86Helion Protocol, Infrastructure: 86Helion Protocol, Transparency: 90
Risk Index components: Helion Protocol Code 90, Operational 88, Governance 84, Economic 86, Infrastructure 86, Transparency 90
ComponentHelion Protocol
Code90
Operational88
Governance84
Economic86
Infrastructure86
Transparency90

Grade scale

  1. AAA90–100
  2. AA85–89.9
  3. A80–84.9
  4. BBB75–79.9
  5. BB70–74.9
  6. B65–69.9
  7. CCC60–64.9
  8. CC55–59.9
  9. C50–54.9
  10. D0–49.9

Score history

12 monthly snapshots

Each point is the Risk Index computed from that month’s component values. Markers below the chart show the events that moved a component.
Helion Protocol Quantix Risk Index by month
PeriodQuantix Risk Index
Nov ’2584.7
Dec ’2587.0
Jan ’2687.0
Feb ’2687.0
Mar ’2687.0
Apr ’2687.3
May ’2687.3
Jun ’2687.3
Jul ’2687.7
Aug ’2687.7
Sep ’2687.7
Oct ’2687.7

  1. 9 Jul 2026

    Economic

    Oracle sanity bounds

    APR and balance-change bounds on committee reports.

    • Economic Security+3

  2. 28 Apr 2026

    Infrastructure

    Operator set expanded

    Four new node operators onboarded.

    • Infrastructure Resilience+3

  3. 5 Dec 2025

    Research assessment

    Research assessment completed: Smart Contract Audit

    7 findings (1 high, 3 medium, 2 low, 1 informational). All critical and high findings addressed.

    Read the research assessment
    • Code Security+6
    • Transparency+4

Risk factors

What keeps the score from being higher, most severe first.

  • MediumInfrastructure ResilienceProfile analysis

    Operator concentration

    Correlated failure or slashing among the largest operators would affect a large share of stake.

  • LowGovernance RiskProfile analysis

    Oracle committee trust

    Rebases depend on the committee report; collusion of five members could misreport balances within the sanity bounds.

Recommendations

Each recommendation raises one component to a target value. The score effect is recomputed with the Risk Index model, holding every other component fixed.

  • Infrastructure Resilience: 86 → 90

    Cap stake per operator

    Limit any operator to a fixed share of new deposits.

    +0.4

    → 88.1

  • Economic Security: 86 → 89

    Tighter rebase sanity bounds

    Bound daily balance changes to protocol-specific expectations.

    +0.4

    → 88.1

Analysis

Contract, governance and operations

Contract analysis

Source
Verified
Upgradeability
Transparent proxy
Administrative control
Helion DAO with a 72-hour timelock; 4-of-7 guardian can pause
Enforced delay
72 hours
External dependencies
Permissioned node operators; Oracle committee (5-of-7)
  • PassSource verified. All contracts verified.
  • PassWithdrawal queue. Withdrawals finalise against reported balances.
  • PassOracle quorum. 5-of-7 committee with sanity bounds on reported APR.
  • CautionOperator concentration. Three operators run more than half of validators.

Governance exposure

Low

DAO governance with a 72-hour timelock; the guardian can pause deposits but not move funds.

Operational resilience

Strong

Operators are monitored for performance and slashing; withdrawal credentials point to the vault.

Monitoring

Monitoring history

2 recorded security events for Helion Protocol, most recent first.
Open in Security Monitoring
  1. 9 Oct 2026MediumWithdrawal request for 1.2% of hETH supplyWhale Activity · StakingPoolAcknowledged
  2. 11 Feb 2026LowOracle committee quorum raised from 5/9 to 6/9Configuration Change · AccountingOracleResolved

Research assessment

QX-TSA-2026-009Smart Contract AuditPublished

Staking pool, rebasing hETH, operator registry, accounting oracle and withdrawal vault. 2,486 nSLOC of Solidity.

Review 10 Nov 2025 – 5 Dec 2025 · published 12 Jan 2026

Critical0
High1
Medium3
Low2
Informational1
  • 6 resolved
  • 0 partially resolved
  • 1 acknowledged
  • 0 open
Read the assessmentReport PDF

Continue with

Comparable protocols

Compare side by side

Research

Relevant research

Publications on the risks that matter most for a liquid staking protocol.

Architecture

System components

StakingPool
Deposits, minting and the withdrawal queue
hETH
Rebasing liquid staking token
OperatorRegistry
Node operators, keys and deposit limits
AccountingOracle
Committee reports of validator balances
WithdrawalVault
Receives beacon-chain withdrawals

Turn risk factors into a remediation plan.

A research assessment traces each weakness to code, configuration or process, and verifies the fix before the score moves.

Discuss Your Security RequirementsBack to the Security Explorer