Following the rsETH attack in April, Aave released a post-mortem stating that the loss did not stem from a vulnerability in the protocol's own contract, but rather from a failure of the LayerZero cross-chain bridge verification used by KelpDAO. This incident prompted Aave to review all assets in V3 and tighten its scrutiny of collateral listings.

The attack originated from the cross-link bridge.

According to Aave's disclosure, attackers exploited a single validator to allow forged cross-chain messages, minting 116,500 rsETH tokens on Ethereum that were not backed by any actual assets. These tokens were then deposited into Aave and used as collateral to borrow funds, ultimately resulting in an unrecoverable loss for the protocol.

Aave states that the lending logic of the protocol itself operates as designed; the real failure lies in the bridging verification process upon which assets rely before entering the protocol. This means that the risk no longer comes solely from application-layer contracts but may also stem from cross-chain and off-chain infrastructure.

V3 All assets enter review

Aave stated that in the future, when evaluating collateral, it will no longer only look at price volatility, liquidity, and contract audit results, but will also include cross-chain bridges, oracle reliance, third-party contracts, custody arrangements, and operational security in its review.

• Cross-chain bridge infrastructure and verification methods
• Oracle dependency and third-party contract risks
• Trusteeship arrangements and operational safety measures

This review argues that the connections between DeFi protocols are becoming increasingly deep, and looking at the tokens themselves is no longer sufficient to cover all the risks. The bridging networks, verification systems, and operational processes behind the assets may also directly impact protocol security.

295 parameter adjustments have been performed.

Aave also proposes a faster, automated defense solution. When a collateralized asset triggers a preset risk threshold, the system can automatically reduce its loan-to-value ratio to zero, directly canceling its borrowing capacity to reduce the risk from spreading to a wider area.

Since the incident, Aave's risk management team has implemented approximately 295 parameter adjustments in the V3 market, including 168 supply cap reductions and 66 borrowing cap reductions, with the aim of reducing exposure to single assets.