The Day DeFi Changed Forever

Although not even in the top 10 crypto hacks in terms of dollar-size, the LayerZero<>KelpDAO<> Aave DeFiAave is an Open Source lending ProtocolView Profile” class=”stubHighlight”> Aave exploit will go down in history as the most consequential DeFi hack of all time. 

The entire onchain industry is now on a completely different path than we were before. 

The implications to crypto come in two buckets:

1. DeFi needs to be Rearchitected 
2. Validators/Security Councils will need to standardize recovery operations (or give up control)

DeFi Needs to be Rearchitected 

The LayerZero<>KelpDAO<>Aave exploit occurred because each component in their composable DeFi stack trusted each other. 

1. KelpDAO Liquid StakingKelpDAO is a Liquid Restaking Protocol for EigenLayerView Profile” class=”stubHighlight”> KelpDAO trusted that LayerZero’s DVN wouldn’t ever be compromised (it got compromised).
2. LayerZero BridgeLayerZero is a cross-chain infrastructure protocol enabling secure data transfer.View Profile” class=”stubHighlight”> LayerZero trusted KelpDAO to choose the appropriate level of security (they didn’t)
3. Aave trusted KelpDAO’s rsETH collateral to always be fully backed (it wasn’t) 

Trust lowers the costs of transactions and improves the welfare of everyone involved. So, it’s enticing to assume these protocols are operating inside of trustworthy environments.

But they are not.

Permissionless systems are inherently adversarial environments. Building under the premise that 99.99% of users are good doesn’t change the fact that it only takes one bad actor to attack the system. 

The LayerZero<>KelpDAO<>Aave structure forgot this paradigm.