Aave Faces Potential Losses of Up to $230 Million Following Kelp DAO Bridge Exploit

A recent exploit targeting the Kelp DAO and LayerZero bridge has put lending protocol Aave at risk of incurring significant losses, potentially up to $230 million, contingent upon the resolution of the situation. The incident, detailed in a report by Aave Labs and LlamaRisk, revolves around rsETH, a liquid restaking token issued by KelpDAO, which utilizes a bridge mechanism to transfer tokens between blockchains. An attacker exploited this setup by creating a forged transfer message, leading to the creation of new, unbacked tokens. The attacker then deposited these tokens into Aave as collateral and borrowed approximately $190 million in ETH and related assets. Aave swiftly responded by freezing rsETH markets, adjusting loan-to-value ratios, and halting new borrowing against the asset. The outcome now hinges on Kelp's handling of the shortfall, with potential losses ranging from $124 million if spread across all rsETH holders to $230 million if confined to Layer 2 networks. The exploit highlighted weaknesses in Kelp's cross-chain message verification process using LayerZero, allowing the attacker to extract value from the system. In response to the incident, users withdrew around $6 billion in total value locked from Aave, reflecting a broader pullback amidst uncertainty. Discussions are underway to address potential losses, with the report noting that Aave's DAO treasury holds approximately $181 million in assets.