The risk management structure of Aave is strained following a notable exploit by Kelp DAO that revealed weaknesses in the interwoven systems of DeFi.

The event that cost the theft of around $293 million in value of rsETH has caused concerns about systemic risk in lending protocols.

Exploit Triggers Systemic Risk Concerns

This attack was a result of a bug in the LayerZero bridge of Kelp DAO, which allowed the hacker to mint 116,500 tokens in the form of rsETH and use them as collateral on the Aave V3 to borrow wrapped Ethereum (wETH). This caused unsecured positions and led to liquidity stress.

LlamaRisk notes that the incident highlights that a single bridge exploit can trigger liquidity crunches and mass withdrawals across interconnected protocols. After the exploit, Aave saw almost $10 billion worth of value leave the site and it was a strong indicator of a drop in user trust.

Two Bad Debt Scenarios Identified

LlamaRisk analysis indicated that there are

The second case transfers the total liability to Layer 2 ecosystems like Arbitrum and Mantle and the bad debt is notably high, at approximately $230.1 million. The report noted that Aave had around $181 million in its treasury that would partially cover losses.

Liquidity Stress and Protocol Response

The attack caused excessive liquidity pressure in Aave. Based on market data, there were more than $5.4 billion of ETH withdrawals as users scrambled to sell positions, pushing liquidity usage near 100%.

As a reaction, Aave froze rsETH markets and could use its Umbrella security model to cover losses in wETH, noting that 18,922 Aave Wrapped ETH (aWETH) tokens worth nearly $43.7 million have entered the unstaking cooldown phase.