{"id":"EIP-7044","name":"Perpetually Valid Signed Voluntary Exits","status":"Final","chain":"ethereum","category":{"id":"security","name":"Security & Trust","description":"Helping users verify, control, and protect their assets"},"journeyStages":[{"id":"approving","name":"Approving & Permissioning","description":"Granting permissions for actions"},{"id":"executing","name":"Executing Transactions","description":"Performing on-chain actions"},{"id":"status","name":"Status & Confirmation","description":"Waiting for and confirming outcomes"}],"uxImpact":"EIP-7044 makes a correctly signed voluntary exit remain valid across future Ethereum upgrades by fixing its signing domain to Capella. Dencun activated the change on Ethereum mainnet. It simplifies delegated staking operations, but a signed exit is still an authority-bearing artifact: users need to see the validator, signer, fork/domain, custody relationship, and the fact that the signature cannot be revoked by this EIP.","slug":"eip-7044","officialUrl":"https://eips.ethereum.org/EIPS/eip-7044","sources":[{"label":"Official specification","url":"https://eips.ethereum.org/EIPS/eip-7044","type":"official-spec"},{"label":"Discussion search","url":"https://ethereum-magicians.org/search?q=EIP-7044","type":"discussion"},{"label":"Dencun mainnet announcement","url":"https://blog.ethereum.org/2024/02/27/dencun-mainnet-announcement","type":"reference"},{"label":"Deneb consensus specification","url":"https://github.com/ethereum/consensus-specs/blob/master/specs/deneb/beacon-chain.md","type":"implementation"},{"label":"EIP-4895 official specification","url":"https://eips.ethereum.org/EIPS/eip-4895","type":"official-spec"}],"lastReviewed":"2026-09-18","lastUpdated":"2026-09-18","hasDetailedContent":true,"content":{"id":"EIP-7044","sources":[{"label":"EIP-7044 official specification","url":"https://eips.ethereum.org/EIPS/eip-7044","type":"official-spec"},{"label":"Dencun mainnet announcement","url":"https://blog.ethereum.org/2024/02/27/dencun-mainnet-announcement","type":"reference"},{"label":"Deneb consensus specification","url":"https://github.com/ethereum/consensus-specs/blob/master/specs/deneb/beacon-chain.md","type":"implementation"},{"label":"EIP-4895 official specification","url":"https://eips.ethereum.org/EIPS/eip-4895","type":"official-spec"}],"lastReviewed":"2026-09-18","lastUpdated":"2026-09-18","summary":"EIP-7044 makes a correctly signed voluntary exit remain valid across future Ethereum upgrades by fixing its signing domain to Capella. Dencun activated the change on Ethereum mainnet. It simplifies delegated staking operations, but a signed exit is still an authority-bearing artifact: users need to see the validator, signer, fork/domain, custody relationship, and the fact that the signature cannot be revoked by this EIP.","partialDeployment":{"body":"The change is part of Ethereum's Deneb/Dencun consensus rules. Other networks or staking systems need their own activation and client support. The EIP does not create a wallet, custody service, operator approval flow, or exit-timing guarantee."},"designerTakeaways":["Treat a pre-signed exit as a powerful bearer artifact and show who can submit it, which validator it names, and where the funds withdraw.","Distinguish signing, artifact handoff, submission, consensus acceptance, exit queue, and eventual withdrawal.","Warn that Capella-domain exits remain valid across upgrades and may be replayable on a maintained fork; the application must define its custody and distribution policy."],"applicability":{"whenToUse":["A staking operator, pool, or custodian collects voluntary-exit signatures before an operator change or custody event.","A product needs to monitor a signed exit artifact across network upgrades.","The product can verify validator public key, exit epoch, signer, domain, and destination credential before accepting an artifact."],"whenToAvoid":["The product cannot securely store, revoke, or transfer a signed exit artifact.","Users expect a signature request to be a temporary authorization with automatic expiry.","The selected network does not implement the Deneb/EIP-7044 rule."]},"prototypeFirst":[{"screen":"Pre-signed exit review","why":"Signing creates an enduring ability to initiate a validator exit, so the user must understand the complete authority boundary.","covers":["Correct validator","Correct signer","Domain mismatch","Already exited"],"include":["Validator public key and index","Exit epoch","Withdrawal credential","Capella domain","Storage and submission policy"]},{"screen":"Operator handoff and exit tracking","why":"The artifact may be signed by one party and submitted by another long after signing.","covers":["Signed and stored","Submitted","Accepted","Queue pending","Completed"],"include":["Artifact owner","Submission authority","Submission timestamp","Consensus status","Recovery contact"]}],"mentalModel":[{"label":"Active key","description":"The validator's active signing key signs the voluntary-exit message, even when a separate party owns the withdrawal credential."},{"label":"Exit artifact","description":"The signed voluntary exit names a validator and an epoch; a valid holder can submit it to the consensus network."},{"label":"Fixed domain","description":"EIP-7044 validates the signature with the Capella fork version even after later upgrades, so a correctly signed exit remains valid."},{"label":"Consensus submission","description":"A signed artifact is not an exit until it is submitted, accepted, and assigned the protocol's exit state and queue."},{"label":"Withdrawal outcome","description":"Validator exit, withdrawable epoch, and execution-layer balance credit are later states with separate timing and destination rules."}],"statesToDesign":[{"state":"Ready to sign","trigger":"The validator is active and the product has verified signer, credential, network, and exit epoch.","userNeed":"Know exactly which validator authority they are creating.","designResponse":"Show validator public key, index, operator, withdrawal destination, exit epoch, domain, and artifact handling before signing."},{"state":"Signed and stored","trigger":"The active key has produced a valid signature but no submission occurred.","userNeed":"Know who can use the artifact and how to protect or transfer it.","designResponse":"Show storage owner, submission authority, signed-at timestamp, and the non-revocation policy."},{"state":"Invalid or mismatched signature","trigger":"The signature, validator key, domain, or message fields fail validation.","userNeed":"A concrete correction instead of a generic signing error.","designResponse":"Name the field that failed and block handoff or submission until a new artifact is signed."},{"state":"Submitted and gossiping","trigger":"A valid artifact was sent to consensus clients.","userNeed":"Know that network propagation is underway, not that the validator has exited.","designResponse":"Show submission ID or receipt, propagation status, and the validator's current state."},{"state":"Exit queued","trigger":"Consensus accepted the exit and assigned an exit epoch.","userNeed":"Understand when validator duties end and when funds become withdrawable.","designResponse":"Show exit epoch, estimated queue range when available, withdrawable epoch, and destination separately."},{"state":"Already submitted or exited","trigger":"The validator has an existing exit or the artifact was reused.","userNeed":"Know that another signature or retry is unnecessary.","designResponse":"Show the existing protocol record and keep the artifact audit trail without claiming a second action occurred."}],"designDecisions":[{"question":"Can a signed exit be revoked?","recommendation":"Explain that EIP-7044 does not define revocation; control access to storage and submission, and make the operator policy explicit.","rationale":"Perpetual validity changes how long a leaked or misrouted artifact can remain usable."},{"question":"What should be visible in a signing prompt?","recommendation":"Show the validator identity, exit epoch, withdrawal credential, signer, and Capella domain before the signature is created.","rationale":"A generic validator name hides both the target and the enduring authority being granted."},{"question":"How should the UI handle a fork?","recommendation":"Show the target network and fork policy and disclose that a Capella-domain artifact may remain valid on a maintained fork.","rationale":"The fixed domain trades future upgrade compatibility for weaker fork-specific replay separation."}],"problemsSolved":[{"problem":"Operators must collect new exit signatures after each upgrade","oldWay":"Pre-sign exits repeatedly with a moving fork domain or keep the active key online.","newWay":"A Capella-domain exit remains valid across future Ethereum upgrades.","impact":"high"},{"problem":"Withdrawal owners cannot prepare an operator handoff safely","oldWay":"Rely on trust that the active-key operator will produce an exit later.","newWay":"A custody product can hold a pre-signed, validator-specific exit artifact for a defined submission policy.","impact":"high"},{"problem":"Users cannot distinguish a signature from a completed exit","oldWay":"Mark the validator exited as soon as the signer approves.","newWay":"Track signature creation, handoff, consensus submission, queue assignment, and withdrawal separately.","impact":"critical"}],"uxPatterns":[{"name":"Pre-Signed Exit Vault","description":"Store a validator-specific exit artifact behind explicit custody and submission controls.","components":["Validator identity card","Domain and signer review","Artifact custody badge","Submission policy"],"userFlow":["Select an active validator","Verify signer, withdrawal credential, and network","Review exit epoch and Capella domain","Sign and store the artifact","Grant or revoke access to the submission service through the product's own controls"]},{"name":"Exit Lifecycle Timeline","description":"Show the difference between an enduring signed artifact and the protocol's later exit and withdrawal states.","components":["Signed badge","Submission receipt","Exit queue row","Withdrawable epoch","Balance credit"],"userFlow":["Create or import a signed exit","Validate the artifact","Submit to consensus clients","Track exit and withdrawable epochs","Confirm execution-layer withdrawal credit"]}],"uiComponents":[{"name":"SignedExitReview","description":"Displays validator identity, exit epoch, signature domain, signer, and withdrawal destination before signing or import.","kind":"card","states":["ready","domain-mismatch","invalid","already-exited","signed"],"props":["validatorPubkey","validatorIndex","exitEpoch","withdrawalCredential","domain","signer"]},{"name":"ExitArtifactTimeline","description":"Tracks artifact custody and consensus exit progress separately.","kind":"progress","states":["unsigned","signed","stored","submitted","accepted","queued","withdrawable"],"props":["artifactId","storageOwner","submissionAuthority","exitEpoch","withdrawableEpoch"]}],"antiPatterns":[{"pattern":"Calling a signed exit a completed exit","why":"Signing creates an artifact; only consensus processing changes validator state.","instead":"Show signed, submitted, accepted, queued, and completed states.","severity":"critical"},{"pattern":"Treating a pre-signed exit as revocable","why":"EIP-7044 does not provide revocation after the artifact is created.","instead":"Protect storage and submission access and state the product's operational controls.","severity":"critical"},{"pattern":"Hiding the fork domain and validator public key","why":"The fixed domain and precise validator target define the artifact's scope and replay behavior.","instead":"Show both in the review and artifact record.","severity":"high"},{"pattern":"Promising a fixed exit or withdrawal time","why":"Exit and withdrawal queues are protocol states affected by validator activity and network churn.","instead":"Show live epochs and network-derived ranges.","severity":"high"}],"vocabulary":[{"use":"Signed exit artifact","avoid":"Exit approved","why":"Approval could imply the validator already entered the exit queue."},{"use":"Valid across upgrades","avoid":"Never expires","why":"Perpetual validity is about fork-version checking and does not override validator state or network rules."},{"use":"Submission authority","avoid":"Owner","why":"The party holding or submitting the artifact may differ from the withdrawal-credential owner."}],"specConstraints":[{"id":"capella-domain","constraint":"Correctly signed exits use the Capella fork domain to remain valid across future upgrades, while older Deneb-domain pre-signed exits lose expected validity.","appliesTo":"application","normativity":"backwards-compatibility","specQuote":"## Backwards Compatibility\n\nThis change is backwards compatible to the Consensus Layer of Ethereum block processing logic.\n\nThe expectation of future validity of exits is not forward compatible. Specifically, users who have already pre-signed exits utilizing the Deneb fork domain with an expectation of their validity should be aware that these pre-signed exits will no longer be recognized as valid. Consequently, users should adjust their approach moving forward. For continued validity across forks, including Deneb and subsequent forks, users should ensure that their exits are signed using the Capella fork domain.\n\nThere are no forwards/backwards compatibility issues with the Execution Layer.","specSection":"Backwards Compatibility","specUrl":"https://eips.ethereum.org/EIPS/7044#backwards-compatibility","designImplication":"Show the fork domain in exit-signing and custody flows and distinguish a signed artifact’s future validity from current submission status."},{"id":"fork-replay-risk","constraint":"Changing signature domains removes prior replay protection across forked networks, although funds and chain security are not directly put at risk by this change.","appliesTo":"application","normativity":"security-considerations","specQuote":"## Security Considerations\n\nThe divergent signature domains across forked networks would previously have prevented the replay of VoluntaryExits after two hard forks. This specification change causes the replay protection to no longer exist. These potential replays could impact individual stakers on both sides of a fork, but does not put funds at risk and does not impact the security of the chain.","specSection":"Security Considerations","specUrl":"https://eips.ethereum.org/EIPS/7044#security-considerations","designImplication":"Warn about maintained-fork replay and show validator, signer, domain, and submission policy before users hand off a pre-signed exit."}],"technicalNotes":"EIP-7044 changes consensus-layer process_voluntary_exit validation to compute the signing domain and signing root with CAPELLA_FORK_VERSION. The change is included in the Deneb consensus upgrade and does not modify the execution layer. Exits signed with a Deneb fork domain under the old expectation are not automatically made valid; future cross-upgrade validity requires Capella-domain signatures. The fixed domain weakens fork-specific replay separation, although the EIP states this does not put funds at risk on its intended networks.","relatedStandards":[{"id":"EIP-7002","relationship":"Execution-layer withdrawal-credential requests that provide a different exit authority path."},{"id":"EIP-7251","relationship":"Electra validator balance and consolidation changes that affect exit and withdrawal state."}],"keyTakeaways":["EIP-7044 makes Capella-domain voluntary exits valid across later Ethereum upgrades.","A signed exit is an enduring authority-bearing artifact, not a completed exit.","Show validator, signer, domain, destination, custody, and submission policy before signing.","Do not promise revocation, fork isolation, or fixed queue timing from the EIP alone."]},"urls":{"canonical":"https://www.eipsfordesigners.com/standards/EIP-7044","markdown":"https://www.eipsfordesigners.com/standards/EIP-7044/content.md","agent":"https://www.eipsfordesigners.com/standards/EIP-7044/agent.md","api":"https://www.eipsfordesigners.com/api/standards/EIP-7044","official":"https://eips.ethereum.org/EIPS/eip-7044","discussion":"https://ethereum-magicians.org/search?q=EIP-7044"},"freshness":{"lastReviewed":"2026-09-18","lastUpdated":"2026-09-18"}}