Aave Completes Liquidation of KelpDAO Hacker’s Remaining rsETH Position Across Ethereum and Arbitrum

Aave, a leading decentralized finance protocol, has executed the liquidation of the remaining rsETH position linked to the KelpDAO hacker. The move, reported by The Block, represents the final step in a previously disclosed recovery plan that required a governance vote to temporarily adjust the rsETH oracle price. The liquidation was carried out on both the Ethereum and Arbitrum networks, marking a coordinated effort to recover funds stolen in an earlier exploit.

Background of the KelpDAO Exploit and Recovery Plan

The KelpDAO hack, which occurred earlier this year, resulted in the theft of significant crypto assets, including rsETH tokens. In response, the Aave community and the KelpDAO team collaborated on a recovery strategy. A critical component of this plan was a governance proposal that temporarily modified the oracle price feed for rsETH on Aave. This adjustment was necessary to accurately reflect the asset’s value and enable the liquidation of the hacker’s position without causing undue market disruption or further losses to the protocol.

The liquidation process on Aave is automated and triggered when a borrower’s collateral value falls below a certain threshold. By adjusting the oracle price, the community ensured that the hacker’s position could be liquidated in a controlled manner, returning funds to the protocol and its users.

Execution Across Ethereum and Arbitrum

The liquidation was executed on both the Ethereum mainnet and the Arbitrum layer-2 network. This dual-network approach reflects the hacker’s original activity, which spanned multiple chains to maximize the exploit’s impact. Aave’s cross-chain infrastructure allowed the recovery team to target positions on both networks simultaneously, ensuring a comprehensive recovery.

According to on-chain data, the liquidation successfully closed the hacker’s remaining rsETH position, converting the collateral into Aave’s native stablecoin, GHO, and other assets. The recovered funds are expected to be returned to affected users as part of the ongoing remediation efforts.

Implications for DeFi Security and Governance

This event underscores the importance of robust governance mechanisms in decentralized finance. The ability of the Aave community to swiftly pass a proposal and adjust protocol parameters in response to a security incident demonstrates the flexibility and resilience of DeFi systems. However, it also highlights the challenges of oracle manipulation and the need for secure price feed mechanisms.

For Aave, this successful recovery reinforces its reputation as a responsible and community-driven protocol. For the broader DeFi ecosystem, it serves as a case study in coordinated incident response and the potential for governance to mitigate the impact of hacks.

Conclusion

The liquidation of the KelpDAO hacker’s remaining rsETH position by Aave marks a significant milestone in the recovery process. Through a combination of governance action and technical execution, the protocol has demonstrated its ability to respond to security threats effectively. While the incident highlights ongoing risks in the DeFi space, it also provides valuable lessons for improving security and governance standards across the industry.

FAQs

Q1: What is rsETH and why was it targeted?
rsETH is a liquid staking token issued by KelpDAO, representing staked ETH. The hacker exploited a vulnerability in the KelpDAO protocol to obtain a large amount of rsETH, which was then used as collateral on Aave.

Q2: How did the oracle price adjustment work?
The Aave governance community passed a proposal to temporarily adjust the oracle price feed for rsETH to a more accurate value. This allowed the protocol to liquidate the hacker’s position without causing a market panic or further losses.

Q3: Will affected users get their funds back?
Yes, the recovered funds from the liquidation are expected to be returned to affected users as part of the ongoing remediation plan coordinated by the KelpDAO team and Aave.