LayerZero acknowledges mistakes following the $292 million hack of Kelp, committing to improved security measures and transparency.
LayerZero has issued a public apology for its inadequate response to the recent Kelp hack, acknowledging that utilizing a single-verifier setup for major transactions was a misstep.
On April 17, a significant breach occurred where around $292 million worth of rsETH was stolen from the Kelp liquid staking platform through a cross-chain bridge utilizing LayerZero's services. Subsequent investigations clarified that the breach stemmed from vulnerabilities in infrastructure rather than a flaw in smart contracts, specifically pointing to a single-verifier configuration (1/1 DVN).
Initially, LayerZero attributed the breach to local issues within Kelp, but critics contended that the 1/1 DVN setup was in line with standard practices for protocol integration. Data from Dune Analytics indicated that nearly half of LayerZero applications operated under this security model at the time of the incident.
In their statement, LayerZero admitted, "We made a mistake by allowing our DVN to operate as 1/1 for high-value transactions. We did not control the security of the solution, which created risks we did not foresee." The platform outlined several measures to enhance security following the incident:
- Transitioning from a single-verifier to a default 5/5 configuration, requiring at least 3/3 verification.
- Creating an additional DVN client.
- Introducing Console, a centralized system for monitoring security and anomalies for asset issuers.
- Raising the multi-signature requirement from a 5/3 to a 7/10 threshold for all blockchains.
In the aftermath, the Kelp team has opted to switch to Chainlink's CCIP protocol due to disagreements with LayerZero regarding the hack's underlying causes. Similarly, the Solv Protocol, a Bitcoin initiative, has also migrated away from LayerZero's cross-chain framework in favor of CCIP.
