Aave Releases Post-Mortem on Kelp rsETH Bridge Attack Impact

The decentralized finance (DeFi) lending giant Aave has published a comprehensive post-mortem investigation following the security breach involving the Kelp rsETH LayerZero V2 bridge. The incident, which took place on April 18th, involved a sophisticated exploit that allowed an attacker to manipulate cross-chain messaging to illicitly acquire assets. While the protocol itself remained structurally sound, the attacker utilized the Aave V3 markets on Ethereum and Arbitrum to leverage the stolen collateral, prompting a detailed review of third-party infrastructure risks within the ecosystem.

Mechanism of the RPC Poisoning Attack

The investigation revealed that the primary vulnerability originated from third-party bridge infrastructure rather than the core Aave smart contracts. The exploiter executed an RPC poisoning attack, specifically targeting a single LayerZero validator. By forging a cross-chain message, the attacker successfully triggered the release of 116,500 rsETH on the Ethereum mainnet. Crucially, this release occurred without the requisite burning of tokens on the source network, Unichain, creating an imbalance of unbacked assets.

• Asset targeted: Kelp rsETH (Liquid Restaking Token)
• Infrastructure exploited: LayerZero V2 bridge
• Primary method: Validator manipulation via RPC poisoning
• Total illicitly released tokens: 116,500 rsETH

Impact on Aave V3 Liquidity Pools

Following the bridge exploit, the attacker moved the illicitly obtained rsETH into Aave V3 deployments on both the Ethereum Core and Arbitrum networks. By using the rsETH as collateral, the perpetrator was able to borrow a significant amount of liquidity from the protocol. Reports indicate the total borrowed sum reached approximately 82,650 WETH and 821 wstETH. This maneuver effectively converted the manipulated bridge tokens into widely used, liquid assets within the DeFi ecosystem.

The exposure primarily originated from third-party bridge infrastructure, not the protocol itself.

The Aave safety modules and risk management parameters were monitored closely throughout the event. Although the protocol functioned as designed regarding collateralization and borrowing limits, the influx of unbacked rsETH posed a unique challenge to the market's stability.

Conclusion

The Kelp rsETH incident highlights the ongoing security challenges associated with cross-chain interoperability and the dependencies DeFi protocols have on external bridge validators. Aave's post-mortem serves as a reminder that even audited lending platforms can be impacted by vulnerabilities in the underlying assets they support. Moving forward, the community and developers are expected to focus on stricter integration standards for Liquid Restaking Tokens (LRTs) and enhanced monitoring of bridge-related infrastructure to mitigate similar risks in the future.