Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent bridge exploit involving Kelp DAO and LayerZero has put lending protocol Aave at risk of losses totaling up to $230 million, pending resolution. According to a report by Aave Labs and LlamaRisk, the incident revolves around rsETH, a liquid restaking token issued by KelpDAO. The protocol utilizes a bridge mechanism to transfer rsETH between blockchains, which was exploited by an attacker who forged a transfer message, resulting in the creation of new tokens without backing. The attacker then deposited the tokens into Aave as collateral and borrowed approximately $190 million in ETH and related assets. Aave quickly responded by freezing rsETH markets, setting loan-to-value ratios to zero, and halting new borrowing against the asset. The outcome depends on Kelp's handling of the shortfall, with potential losses ranging from $124 million if spread across all rsETH holders to $230 million if isolated to Layer 2 networks. The exploit was made possible by weaknesses in Kelp's verification of cross-chain messages using LayerZero, allowing the attacker to manipulate the process and extract value from the system.