KelpDAO Sues LayerZero Over $292 Million rsETH Exploit, Claims Bridge Risks Were Not Disclosed

KelpDAO has filed a lawsuit against LayerZero as well as its co-founder Bryan Pellegrino in British Columbia following the April 18 attack that resulted in the loss of 116,500 rsETH, amounting to roughly $292 million (roughly Rs. 2,797 crore). According to KelpDAO, which stated this on September 24, Evercrest Technologies Inc., the corporate body behind Kelp, brought forth the lawsuit. As per the claims, as highlighted on the official website of KelpDAO, LayerZero had failed to disclose any potential weaknesses and risks regarding the technologies that were being used and had allowed attackers to compromise their verification system.

LayerZero Attributes the Incident to a Single-Verifier Bridge Setup

Pellegrino is contesting the claim. In his response, Pellegrino stated that he considers the claims to be “meritless” and that he will defend himself and LayerZero in Vancouver. At present, reports indicate that the civil claim includes both Pellegrino and LayerZero individually. Part of the claim made by KelpDAO is based on the configuration of the bridge that was used for rsETH. According to the protocol, LayerZero had already approved the deployment and configuration of the bridge, contradicting LayerZero's later argument that Kelp created a dangerous single-verifier setup. 

LayerZero also came up with an alternative explanation. In a statement released by the company in April concerning the incident, LayerZero stated that Kelp employed a DVN configuration known as a 1-of-1 Decentralised Verifier Network. This means that there was no individual verifier that could refute a false message sent through the cross-chain network. LayerZero also argued that it had previously recommended verifier diversification and stated that the configuration was a single point of failure. 

There is a dispute over accountability between the two sides, but LayerZero's official report concludes that hackers were able to breach LayerZero Labs' infrastructure prior to the release of funds through the rsETH bridge. LayerZero made this detailed report public in May, stating that the attack started on March 6 when the attacker socially engineered a LayerZero developer and got his session credentials. This way, the attacker was able to breach LayerZero's RPC cloud network and tamper with the internal RPC nodes.

Following the attack in May, DeFi protocol Kelp DAO announced that it will be migrating its staking token, rsETH, to the Chainlink oracle platform. The protocol continues to place the blame for the attack on LayerZero's cross-chain infrastructure. LayerZero argued that the hack occurred because of an inadequate setup tied to Kelp's decentralised verifier network (DVN), which relied on a single LayerZero DVN as the only verified path, rather than requiring multiple checks of cross-chain transactions. LayerZero had advised against such a setup.