Founder @kernel_dao and @staderlabs Prev - @LinkedIn, @facebook
Joined October 2020
- Tweets253
- Following79
- Followers504
- Likes342
Going to repeat this. This is a misunderstanding!
In both cases, collateral stolen from an actor was used to borrow ETH from DeFi.
1. No new rsETH was minted. Kelp backed DeFi United to make everyone whole rather than let specific parties (users / lenders / L2s) suffer losses.
2. USDT is fully backed, but Binance could take legal action to claim "their" collateral back.
Aave has no issue btw
The hacker put in usdt and borrowed eth
Eth went down and the usdt collateral is real money
In the kelp situation the hacker put in tokens backed by nothing
48
This is a misunderstanding.
In both cases, collateral stolen from an actor was used to borrow ETH from DeFi.
1. No new rsETH was minted. Kelp backed DeFi United to make everyone whole rather than let specific parties (users / lenders / L2s) suffer losses.
2. USDT is fully backed, but Binance could take legal action to claim "their" collateral back.
Aave protocol will be fine.
The hacker supplied 60M USDT and borrowed 19,762 wETH (~44.9M$) in 3 minutes, before Tether froze their address and before the Aave Guardian froze the Aave V3 Core reserves (46 min later).
But USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol: health factor 1.04, 59.9M$ of collateral against 44.9M$ of debt.
Sure, we now have a large borrower with little incentive to repay their loan, but liquidations work as usual: if ETH goes above ~2,365$ (+4%), the position gets liquidated like any other.
The Aave V3 Core wETH reserve is 2.16M wETH, so the hacker's debt is "only" 0.9% of it as I'm writing this.
I don't think Aave needs to take specific action against the hacker.
345k wETH is available right now (81.6% utilization), so wETH liquidity is sufficient if wETH depositors want to withdraw
There's no reason or need for a bank run.
The situation is much less dire than during the Kelp hack (zero-value collateral), and we should not expect a re-run of "DeFi United".
On paper, a governance proposal could force-liquidate the hacker by upgrading the Pool to target this single position (lowering the USDT liquidation threshold would hit every USDT supplier),
but I see no real upside in doing that as normal liquidation can eat this up without sweat.
The reserves are frozen now, but no need to panic; you can repay and withdraw. This isn't the first time this has happened, and it won't be the last, and Aave is still there.
Just another day in crypto.
184
C4’s bottom-up audit model was unique. The reports were noisy, but they also surfaced creative, high-signal bugs that made us a stronger DeFi protocol.
Sad to see them go.
After careful consideration, we’ve made the decision to wind down @code4rena. This community has meant a great deal to everyone who has been part of building it, and sharing this news is not easy.
1
2
275
Every DeFi team should read this.
Heeaaaaaaaaated debate broke out in the ETHSecurity Community Telegram earlier today between LayerZero’s Bryan and security researchers.
TLDR summary:
- $3 billion+ of LZ OFTs were recently at risk of being compromised due to a default library contract that LZ Labs could upgrade instantly with no timelock to forge messages (like what happened with rsETH hack)
-According to Banteg, major projects like Ethena and EtherFi were STILL using this default library contract as of a few weeks ago
- There is still $178 million in value exposed to being compromised from projects using default library (look at quote tweet)
- LZ Labs doesn’t need to be malicious for this be risk, they have history of poor opsec (in addition to being hacked by North Korea):
- Onchain data shows LZ Labs multisig signers were engaging in non-multisig signing activity like trading memecoins, swapping on DEX, bridging. All major phishing risks as this mean production multisig keys were connected to websites, not just used for signing
- LZ Labs handled private keys like a high schooler, trading memecoins on production multisig keys, no wonder they got targeted by North Korea, who knows what other poor opsec they have?
THREAD BELOW
1
5
282
Dheeraj Borra retweeted
layerzero solosig dependency check in
if you haven't hardened your config, you are sitting on an unnecessary dependency on layerzero 3/5 solosig.
if it gets compromised, it could instantly drain all the adapters that rely on the default receive library. after the kelp exploit, the vulnerable adapters tallied to $3.13 billion. after some outreach, the number has dropped to $178 million.
good progress, but still not enough. there is still a long tail of projects that have ignored this advice.
i will make this simple for you. here is a full list with exact calls for how to pin the default library.
gist.github.com/banteg/cbf75…
Great to see @LidoFinance putting users first. DeFi is resilient! 💪
A proposal for Lido DAO to contribute to @aave’s coordinated rsETH relief effort has landed on the Research Forum following this week’s Kelp's rsETH LayerZero bridge exploit.
The proposal authorizes a one-time, capped contribution of up to 2,500 stETH to a dedicated relief vehicle, solely as part of a fully funded recovery package. The proposal is designed to reduce broader ecosystem spillover and support an orderly resolution for affected users.
DeFi United. Read more below:
research.lido.fi/t/lido-dao-…
1
5
147
Defi dream is dead only for endogenous Crypto yield.
There's plenty to do in Crypto by bringing tradFi yields in. Look at $KUSD!
@WazzCrypto
The Defi dream is dead
I can get 3.14% APY basically risk free on one of the best tradfi brokers
Or I can risk 100% to make 2.13%-3.5% on some of the "most secure" Defi protocols
You're not even getting paid for the risk anymore on the yield ur just being retarded
2
6
518
Our thesis for Kred is simple.
Credit should be onchain. We start with institutions and expand until everyone, irrespective of geography or age, has access to credit to improve their lives. 💰💰
Excited to work with @chainlink and other stalwart early partners (TBA)!!
The internet made everything on demand, from information to money.
The next challenge: liquidity and credit.
Global payments move $220T+ annually, yet trillions sit idle in pre-funded accounts.
Stablecoins solved speed, not liquidity.
Introducing Kred: The Internet of Credit.
At its core is KUSD, a fully collateralized, rewards-bearing stablecoin, backed by real-world repayments.
@kernel_dao’s latest report by @GAmitej, @disankit, @indrajitghosh89, with contributions from @_ashmorgan_ ( @ethereumfndn Enterprise ) and @chainlink, explores how Kred can replace pre-funding with on-demand, verifiable credit, unlocking $5T+ in idle capital.
Powered by @ethereum. Verified by Chainlink. Scalable by design.
The biggest upgrade to financial infrastructure in decades is here.
📘 Get the report now 👇
kerneldao.com/internet-of-cr…
2
9
1,087
Learn about our journey and how packed our roadmap is for the rest of the year! 🚀
Missed our recent AMA with founders @GAmitej & @galacticminter?
No worries!
Here’s the key alpha from our AMA.
Big props to everyone who tuned in, stay plugged in for more insights, and keep those questions coming for our next Off The Block!
They met Microsoft once and decided to drop the Micro 💀
MicroStrategy is now Strategy. strategysoftware.com/press/m…
9
1,126
Running nodes with @staderlabs is the easiest option. Learn from @aave!
The @aave DAO has never sold a single ETH.
Instead, we provide wETH liquidity on Aave and hold a diversified LST/LRT treasury with @LidoFinance , @RocketPool, @ether_fi, @staderlabs , @KelpDAO & @stakewise_io.
We also run nodes with Stader and soon with Lido, EtherFi & Rocket Pool.
Aave DAO increases its ETH-correlated reserves by ~100 ETH per week.
Just Use Aave.
7
915
Yo, @ErikVoorhees!
@AskVenice is nice.
Having a hard time wrapping my head around this sense of humor though
5
491
Working at a "good" startup teaches you much more than work.
I joined Blend when they were ~50 employees, right after their Series B.
🧵
Said yes to everything in my 20s. What truly changed my life was landing at my first startup Blend, now a public company. Pure chaos, packed office all hours, constant "is this legal, it should be, how do we fix it", back to back large VC rounds raised, 50 to 500 people in what felt like 3 months. Head of BD at the time told me that Blend was growing so fast that every six months he felt like he was buying into working at a new company.
If you are in your 20s and want to know what your made of (and whats possible in the world), get to SF. Find an early stage startup sub 50 employees and work harder than everyone at the company. Learn what it means to try everything and get to an answer. Then leave and start a company. No other education out there will offer you more in the shortest amount of time to absolutely crush it.
1
4
538
Some of these lessons have helped me start successful crypto companies - @staderlabs and @kernel_dao, in a domain that moves *much* faster than Web2 SaaS verticals.
1
4
292