Five Major DeFi Protocols Request Arbitrum DAO Release 30,765 ETH Frozen After Kelp DAO Exploit

Five DeFi protocols led by Aave Labs filed a Constitutional AIP on April 25 requesting Arbitrum DAO release 30,765 ETH frozen after the April 18 Kelp DAO exploit that caused $292 million in losses. The exploit released 116,500 rsETH on Ethereum without proper backing, creating a shortfall of 76,127 rsETH that directly affected Aave V3 Arbitrum users after an attacker borrowed 82,650 WETH against exploited collateral. The Arbitrum Security Council froze the ETH on April 21, and the proposal asks for its transfer to a 2-of-3 Gnosis Safe controlled by Aave, KelpDAO, and Certora for remediation. Aave Labs agreed to indemnify Arbitrum entities against any claims, and the governance process is expected to take approximately 49 days if approved.

KelpDAO Bridge Exploit and Resulting Shortfall

• ▪The attacker borrowed 82,650 WETH plus 821 wstETH against positions created with exploited rsETH on Aave
• ▪Only 40,373 rsETH remained in the KelpDAO adapter as confirmed backing for 152,577 rsETH in remote-chain claims at the time of the Llamarisk incident report
• ▪The KelpDAO rsETH exploit occurred on April 18
• ▪The KelpDAO rsETH Unichain-to-Ethereum bridge released 116,500 rsETH on Ethereum without a corresponding source-side burn
• ▪The attacker supplied 89,567 rsETH to Aave across its Ethereum Core and Arbitrum markets during the KelpDAO exploit
• ▪The KelpDAO bridge exploit created an rsETH backing shortfall of approximately 76,127 rsETH
• ▪The KelpDAO rsETH backing shortfall directly affected Aave V3 Arbitrum users

Governance Proposal to Release Frozen Funds

• ▪The Constitutional AIP requests no new treasury allocation from the Arbitrum DAO
• ▪Aave Labs agreed to indemnify the Arbitrum Foundation, Offchain Labs, the Arbitrum Security Council, and each of its members against any claims arising from the freeze, the release, or any related enforcement action
• ▪The Constitutional AIP asks Arbitrum DAO to send the frozen ETH to a designated 2-of-3 Gnosis Safe controlled by signers from Aave, KelpDAO, and Certora
• ▪The recovery address designated in the Constitutional AIP is 0xf228130ce4fAB082C7D5522c90833cec83A9C15e
• ▪Aave Labs, KelpDAO, Layerzero, Etherfi, and Compound filed a Constitutional AIP on the Arbitrum governance forum on April 25
• ▪The Constitutional AIP requests the Arbitrum DAO to release 30,765.67 ETH frozen after the KelpDAO exploit
• ▪The Arbitrum Security Council froze 30,765.667501709008927568 ETH on April 21
• ▪The Arbitrum Security Council moved the frozen ETH to address 0x0000000000000000000000000000000000000DA0

Recovery Process and Timeline

• ▪The Constitutional AIP governance timeline includes a one-week forum discussion, a one-week temperature check, a three-day voting delay, a 14-day onchain vote, an eight-day L2 waiting period, a one-week L2-to-L1 message finalization window, and a final three-day L1 waiting period
• ▪The Constitutional AIP governance process timeline is estimated at approximately 49 days from forum publication to execution
• ▪If Arbitrum DAO approves the Constitutional AIP, recovered ETH will be routed to a 2-of-3 Gnosis Safe for rsETH remediation

Perspective of Aave V3 Arbitrum users affected by the exploit

• ▪Aave V3 Arbitrum users were directly affected by the KelpDAO rsETH backing shortfall despite Aave's smart contracts remaining secure
• ▪The 30,765 ETH frozen by Arbitrum Security Council represents funds that could remediate losses suffered by affected Aave users