According to D2 Finance analysis, the underlying reason for the nearly $300 million attack on the rsETH cross-chain bridge under Kelp DAO has been confirmed on-chain: this incident was not caused by a protocol-level vulnerability in LayerZero, but by a trust issue with the OApp node resulting from a private key leak on the source chain. The analysis states that the rsETH OFT Adapter on the mainnet trusted messages sent from a legitimate deployment node that had been labeled as “Kelp DAO” by LayerZero Scan, which caused a single lzReceive call to directly release 116,500 rsETH from the custodial contract. This indicates that the attack was not due to setPeer injection, but rather the theft of the project’s own source chain private key.

View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin