LayerZero Apologizes for April Exploit, Outlines New Security Measures for Future Protection

LayerZero’s Apology: A Shift in Account

Interoperability protocol firm, LayerZero, recently conveyed apologies concerning their mishandling of the April 18 exploit that resulted in a drain of $292 million from Kelp DAO’s rsETH bridge. This incident stood out not just for its significant financial loss, but the involvement of their own validator as the only verifier pushing through high-value transactions. LayerZero has since acknowledged that their actions were a mistake, and have expressed remorse for not adequately securing their Decentralized Verifier Network (DVN). In an official blog post that began with an ‘overdue apology’, LayerZero admitted that its internal RPC nodes, used by the LayerZero Labs DVN, were compromised by what they believe were members of North Korea’s Lazarus Group. This infiltration poisoned their ‘source of truth’ while their external RPC provider underwent a simultaneous DDoS attack. What’s remarkable is that the protocol wasn’t affected. According to the protocol firm, developers should have the ability to select their own security configurations. However, they admitted to making a mistake in allowing their DVN to operate as a single entity for high-value transactions. Due to the lack of oversight on what the DVN was safeguarding, a blind spot in risk management was created. Going forward, LayerZero has taken responsibility for this oversight. This incident only affected about 0.14% of applications built on LayerZero and roughly 0.36% of the total value of assets across the network. Remarkably, the company has reported that over $9 billion has transited the protocol since the incident on April 19.

Apology Signifies A Departure From Previous Stance

This public apologetic stance is starkly different from LayerZero’s earlier classification of the situation. Previously, the protocol firm asserted that the system had operated flawlessly and blamed Kelp’s manual configuration as the root cause of the problem. In response, Kelp DAO openly disagreed with the account and disclosed that LayerZero had approved the 1-of-1 DVN setup. Subsequent to this, Kelp DAO stated it would change its bridge infrastructure to Chainlink’s CCIP. In a following move, Solv Protocol declared its intentions to move more than $700 million in tokenized bitcoin tech away from LayerZero. Consequently, several changes have been implemented. For starters, the LayerZero Labs DVN is eliminating 1/1 DVN configurations. Also, efforts are being made to transition default settings on all pathways to 5/5, with a base level of 3/3 on chains; especially where only three DVNs are available. This development is significant considering a recent analysis that found that 47% of active LayerZero OApps maintained a 1-of-1 setup. Additionally, LayerZero is in the process of developing a second DVN client in Rust for client diversity, while reconfiguring RPC quorums for a blend of internal, dedicated-external, and shared-external nodes.

LayerZero Admits to a Previously Unreported Incident

Interestingly, LayerZero’s blog post also revealed an earlier unreported event that happened approximately three and a half years prior. Then, a multisig signer used LayerZero’s multisig hardware wallet for a personal transaction instead of a personal device. Following this incident, the signer was removed and wallets were rotated. In line with this, additional anomaly-detection software has been introduced to its signing devices. The protocol firm also disclosed that it has developed a custom multisig called OneSig and will be increasing its multisig threshold from its existing 3-of-5 to a much higher 7-of-10 on all supported chains. OneSig performs transaction hashing locally on the signer’s machine to prevent backend manipulation. It also runs a private anomaly checker. Furthermore, LayerZero stated that it will soon roll out Console; a platform for asset issuers to monitor deployments and make necessary configurations. It comes with an in-built detection for unknown DVNs, ownership amendments, and risky configurations. LayerZero stated that an official post-mortem will be made available after their external security partners wrap up their tasks. Interestingly, the April 18 exploit did not spare Aave; it reportedly left Aave with an estimated bad debt ranging from $124 million to $230 million. Consequently, a coalition of DeFi protocols has drawn a technical roadmap to restore rsETH’s backing. In conclusion, LayerZero’s response to the April 18 exploit has undergone significant changes. The progression from blame deflection to accepting its mistakes, and consequently reforming security measures is an indicator of the company’s commitment to ensure better future implementations. However, only time will confirm the efficacy of these measures and the impact on stakeholders’ confidence in the protocol system.

LayerZero Apologizes for April Exploit, Outlines New Security Measures for Future Protection

LayerZero’s Apology: A Shift in Account

Apology Signifies A Departure From Previous Stance

LayerZero Admits to a Previously Unreported Incident

Latest posts by James Carter

Latest posts from the category All News