RedStone ♦️

Last weekend's incident was a compromise of LayerZero Labs' DVN infrastructure, which affected KelpDAO's rsETH, as it ran on a 1/1 DVN setup with no redundancy to catch the forged message. The attack itself targeted the RPC layer. That's the surface every offchain verifier needs to take seriously right now. This is how we've built RedStone from day one. Every piece of chain data we serve is cross-verified by multiple independent RPC providers, agreeing on the outcome before it gets used. No single provider is ever a critical dependency, and any disagreement gets caught immediately. Across all the networks we support, our stack relies on roughly 20 providers in total. Multiple dedicated nodes are run in parallel to third-party providers. Verifying chain state only through external infrastructure is a trust assumption that needs additional redundancy. Geographic and cluster diversity across every RPC endpoint. Correlated failover is exactly the vector that was exploited here. Independent providers running in the same region on the same infrastructure aren't actually independent when it matters. RPC infrastructure has been one of our most significant infrastructure investments since inception. Sometimes, when reviewing the cost structure, the spending looked expensive. Today, it looks like table stakes for anyone running offchain verification. Redundancy costs real money. Simpler setups look attractive until the day they aren't. State-level actors are now investing real resources into the boring middleware layer nobody pays attention to. RPC poisoning, DDoS-triggered failover, binary swaps on production nodes. None of this is theoretical anymore. As an industry, we need to keep raising the bar so this class of attack doesn't repeat. Fingers crossed for the funds to be recovered and the damage to DeFi protocols kept as small as possible (with initiatives like DeFi United). Rooting for the Kelp and LayerZero teams, and everyone working on tracking and recovery right now. No smart contract hack again. Rather, a configuration exploit. The lesson is for everyone.