Arche

Kann Audits 🤝 @yieldarche We’re excited to announce our official security partnership with Arche! Arche is a yield infrastructure protocol built on Ethereum.

rsETH (@KelpDAO's LST on Ethereum) was exploited for 116,500 rsETH (~$292M). Here's a full breakdown of what happened and where the contagion stands. 1/ How the exploit worked @LayerZero_Core OFTs let a token live across chains: → Lock on chain A → Mint on chain B → Burn on B, unlock on A The security of that unlock depends on the DVNs the app configures. LayerZero does not set this for you. The attacker called `lReceive` on EndpointV2 directly, forging the "B said burn" signal. The adapter on mainnet released real rsETH against nothing. Not a LayerZero protocol bug, but a security configuration failure in the OFT deployment itself. 2/ What happened next Stolen rsETH was deposited into @aave V3, @compoundfinance, and @eulerfinance. ↳ $236M+ in WETH borrowed against it ↳ Real debt, fake collateral, now sitting inside the largest lending pools in DeFi 3/ Contagion map - @aave V3 + V4 → rsETH markets frozen. aWETH Umbrella stakers are the first-loss tranche, DAO second, regular WETH depositors last. - @sparkdotfi → rsETH market frozen - @MorphoLabs → curator-level exposure in isolated markets - @FluidDefi → frozen - @compoundfinance, @eulerfinance → exposure being assessed - @LidoFinance × @mellowprotocol → leveraged meta-vault exposure - @pendle_fi → PT/YT rsETH repricing hard - @upshift_fi → Kelp Gain + High Growth ETH vaults paused - @beefyfinance, @yearnfi → strategies pausing 4/ The L2 problem rsETH on Arbitrum and other chains was bridged via the same OFT mechanism. If the mainnet lockbox is drained, that rsETH on L2s is uncollateralized, backed by nothing. 5/ Why @aave is the systemic risk The ETH market on Aave is ~16.5% backed by rsETH. If losses socialize across mainnet and external chains: → 10–15% emode haircut on rsETH-backed loans → 2–3% residual for ETH suppliers after Umbrella is wiped That is enough for every rational depositor to exit now, and that is exactly what is happening. - Utilization pinned at 100% - Nobody can withdraw WETH - Liquidators can't unwind atomically, no liquidity to pull - Borrowers on stables against ETH collateral can't repay even as rates spike - USDT suppliers are max-borrowing other stables as an exit, positive carry for now, but it deepens the trap So far, Aave has seen $5.5B in ETH outflows.