Five DeFi Protocols Urge Arbitrum to Release 30,765 ETH Post-Exploit

On April 25, a coalition of five decentralized finance (DeFi) protocols submitted a Constitutional AIP to the Arbitrum governance forum, advocating for the release of 30,765.67 ETH that remains locked due to an exploit involving KelpDAO.

The request was put forth by prominent entities: Aave Labs, KelpDAO, Layerzero, Etherfi, and Compound. They are urging the Arbitrum DAO to transfer the frozen ETH into a designated recovery wallet, a 2-of-3 Gnosis Safe managed by signatories from Aave, KelpDAO, and Certora. This action follows the exploit that occurred on April 18, during which a vulnerability in the KelpDAO rsETH bridge was identified.

TRUSTED PARTNER

4.4 ★★★★☆

Review and Opinions →

🔥 100% up to 1 BTC

180 Free Spins 🏆

Open an account

Arbitrum’s Security Council decided to freeze the 30,765.67 ETH on April 21, subsequently moving the funds to an address that is not accessible without governance approval. This step was taken to ensure that proper procedures are followed before any funds can be accessed again.

The exploit occurred due to a flaw in the bridge mechanism of the KelpDAO rsETH system. A recent report by Llamarisk indicated that the KelpDAO rsETH Unichain-to-Ethereum bridge issued 116,500 rsETH on Ethereum without corresponding burns on the source side, violating the essential bridge principle that locked rsETH on Ethereum must back remote-chain minted supplies. At the time of reporting, the backing for 152,577 rsETH claims on remote chains was confirmed to be only 40,373 rsETH, resulting in a backing shortfall of about 76,127 rsETH.

During the incident, the attacker managed to transfer 89,567 rsETH to Aave across its markets and withdrew 82,650 WETH alongside 821 wstETH. It has been clarified that Aave’s smart contracts were not compromised during the exploit; rather, the issue stemmed from an external source.

The coalition believes that the 30,765.67 ETH currently held by Arbitrum is crucial for addressing this shortfall. Their proposal emphasizes that any ETH returned to recovery efforts would help close the funding gap, thereby moving rsETH closer to becoming fully collateralized.

Approval of this governance proposal would allow the recovered funds to be exclusively allocated for compensating losses from the exploit. Should the recovery process face challenges, the involved parties have pledged to seek further guidance from Arbitrum Governance.

TRUSTED PARTNER

4.5 ★★★★☆

Review and Opinions →

🔥 Welcome Bonus 1.500$

150 FS 🏆

Open an account

The timeline for the proposal’s execution is projected to take approximately 49 days, encompassing various stages: a week for forum discussion, another week for a temperature check, a three-day voting delay, a 14-day on-chain vote, an eight-day wait period for Layer 2, a week for finalizing messages from Layer 2 to Layer 1, and an additional three-day waiting period on Layer 1.

Importantly, no new treasury allocations are sought; the proposal solely seeks to release funds that are already frozen on Arbitrum One. The financial impact on the Arbitrum DAO is expected to be minimal, limited to the usual overhead associated with governance execution.

Aave Labs has committed to indemnifying the Arbitrum Foundation, Offchain Labs, the Arbitrum Security Council, and its members against any claims related to the freeze, the potential release of funds, or other enforcement actions tied to the incident.

The community’s consensus is that unlocking these funds would provide a better outcome for Arbitrum users compared to allowing the assets to remain frozen, regardless of whether recovery is complete or partial.