KelpDAO Lawsuit Against LayerZero
In a significant legal move, KelpDAO has initiated a lawsuit against LayerZero and its co-founder, Bryan Pellegrino, following a massive security breach in April that resulted in the theft of 116,500 rsETH, valued at approximately $292 million. On September 24, KelpDAO revealed that the lawsuit was filed by Evercrest Technologies Inc., the entity managing the Kelp application, in British Columbia, aiming to address alleged deficiencies in LayerZero’s infrastructure that contributed to the exploit.
Allegations and Responses
The allegations made by KelpDAO suggest that LayerZero failed to adequately disclose vulnerabilities and took insufficient measures to prevent the hacking incident that exploited its verifier’s security systems. As the situation unfolds, Pellegrino has labeled the claims as “meritless” and stated his commitment to defending both his company and himself in Vancouver’s courts. The legal action specifically accuses Pellegrino and LayerZero of negligence, but no courts have yet evaluated these claims.
Details of the Breach
At the heart of KelpDAO’s lawsuit is the configuration of the rsETH bridge, which Kelp asserts was reviewed and approved by LayerZero prior to the April breach. This contradicts LayerZero’s assertion that Kelp independently opted for a risky “1-of-1 Decentralized Verifier Network”, leaving it exposed. In response to the attack, Kelp argued that its bridge adhered to LayerZero’s prescribed configurations and relied on the infrastructure operated by LayerZero itself, while LayerZero contended that Kelp deviated from recommended configurations.
Incident Report and Technical Accountability
LayerZero’s incident report indicated that the attack began on March 6, initiated through social engineering that compromised a developer’s credentials, subsequently permitting the attacker to manipulate LayerZero’s RPC cloud environment. This vulnerability facilitated the April 18 incident, where attackers harnessed flawed nodes to release rsETH without burning the corresponding amount on the source blockchain.
Crypto intelligence firm Chainalysis classified the exploit as an attack on LayerZero’s off-chain verification methods rather than a flaw inherent in Kelp’s token contract, underscoring the complexities surrounding technical accountability in this case. In a subsequent attempt, the attackers sought to drain an additional 40,000 rsETH, but Kelp managed to halt its contracts just before the fraudulent transaction could be executed.
Consequences and Future Steps
As a consequence of the incident, LayerZero ceased supporting the controversial 1-of-1 DVN configurations and began transitioning applications to setups involving multiple verifiers. Kelp’s lawsuit transforms a previously technical dispute into a significant civil litigation effort, as both parties appear to be jockeying to assign blame for the breach. LayerZero maintains that better verifier protocols initiated by Kelp could have thwarted the exploit.
Notably, security analysts have affirmed that the lack of a second verifier in the network was a critical error that allowed the forged transaction to proceed, while LayerZero has attributed the hacking attempt to the North Korean-linked actor known as TraderTraitor. This attribution, however, does not resolve the fundamental civil issues being contested between Kelp and LayerZero regarding their respective responsibilities leading up to the exploit.
Kelp’s Recovery Efforts
In the aftermath, Kelp has proactively altered its bridge architecture, moving from LayerZero’s framework to utilizing Chainlink’s CCIP for rsETH transactions. By late May, Kelp declared that it had successfully transferred the final segments necessary for its operational recovery, enabling the restart of its minting and redemption processes amidst broader efforts to address financial shortfalls resulting from the exploit.
Litigation Progress
As this civil case is set to advance through the British Columbia court system, established procedures grant defendants like Pellegrino specific timelines to respond, which could further shape the litigation’s trajectory in the coming weeks.
