KelpDAO and Aave have successfully executed the first phase of the rsETH technical recovery plan, burning the attacker’s rsETH on Arbitrum. The exploit on April 18 resulted in a drain of 116,500 rsETH (approximately $290 – $293 million), using a security vulnerability in the LayerZero bridge configuration. The coordinated recovery efforts were implemented under the “DeFi United” initiative, now reaching a critical turning point.
What steps in the “rsETH technical recovery plan” have been completed
The rsETH Technical Recovery Plan has gone through several milestones as follows:
- Attacker’s rsETH has been burned on Arbitrum and removed from circulation, eliminating the fraudulent supply
- Security hardening across all LayerZero bridging configurations; 4 independent attestations are now required to verify versus a single verifier; block confirmations raised from 42 to 64; all L2 to L2 routes/bridges have been deprecated
- BailSec completed audits of the new configurations
- Migration to Chainlink’s Cross-Chain Interoperability Protocol (CCIP) is in progress to add strengthened security to the cross-chain bridging process
The Aave Recovery Guardian and Kelp Recovery Safe will progressively refill 117,132 rsETH over the next two weeks back into the LayerZero Omnichain Fungible Token (OFT) adapter on Ethereum mainnet. Consequently, this ensures that rsETH on mainnet and all Layer-2s will be fully backed during the recovery process.
DeFi community’s impact
The first steps to complete the rsETH technical recovery plan restore confidence in one of the most prominent restaking tokens in the DeFi space. The exploit on April 18 triggered a wave of liquidations on Aave which wiped out billions in total value locked (TVL), and caused widespread panic throughout the ecosystem. The non-traditional collaboration between Aave, Kelp, Arbitrum, Mantle, Ether.fi, Lido, Ethena, LayerZero, and others exemplifies how multi-protocol collaborations can effectively absorb systemic risks.
For rsETH holders, the most immediate relief will be the expected reactivation of withdrawals no later than 24 hours after the first tranche is sent to the LayerZero OFT adapter. All functions related to rsETH (deposits, redemptions, bridging and claims) will resume as expected once the contracts are unpaused.
Next phase
Moving forward, the rsETH technical recovery plan will continue with the progressive refilling of the OFT adapter over two weeks. At the same time, KelpDAO is also in the process of migrating to Chainlink CCIP for further strengthened cross-chain bridging, thereby moving away from a single verifier configuration that allowed for the exploit. Nevertheless, Aave and Kelp have expressed gratitude to their DeFi United partners for being “the cornerstone of this recovery.”
