- Ripple CTO Emeritus David Schwartz suspects Kelp skipped implementing LayerZero’s highly advanced security features in exchange for convenience and operational savings.
- The move played a significant role in the exploit, resulting in the compromise of $292 million in digital assets.
One of the hottest events that shook up the crypto world over the weekend was the massive $292 million heist on Kelp, a liquid restaking protocol. The incident triggered a chain reaction that strongly impacted even Aave (AAVE) as it bridged the stolen assets, leading TRON (TRX) founder Justin Sun to announce he is willing to broker a deal between the hacker and KelpDAO.
In light of the latest developments in the case, Ripple CTO Emeritus David Schwartz alleged that Kelp likely prioritized the convenience of its operations and users over security. The oversight eventually came at a heavy toll.
David Schwartz on Kelp’s Costly Mistake
According to Schwartz, he focused primarily on security and risk when evaluating several Decentralized Finance (DeFi) bridging protocols for the Ripple USD (RLUSD) stablecoin. He claimed that most of the platforms he assessed already demonstrated “strong mechanisms” capable of preventing attacks of the magnitude of the Kelp case.
However, the creator of XRP pointed out that protocols generally recommend skipping rigid security measures in exchange for convenience and reduced operational costs. He recounted that they usually pitched simplicity and ease of integrating more chains, but never bothered to emphasize their best security features. Additionally, he noted that even when they mentioned their advanced security features, they typically centered their discussions on the platform’s ease of use and scalability.
Schwartz suggested that the same factor played a major role in the Kelp exploit. The platform’s failure to leverage LazerZero’s advanced security features out of convenience proved more costly than the supposed operational savings.
Where Simpler Setups Matter
Schwartz stated that simpler setups only make sense when the total value secured in a protocol is relatively small. The same applies when a trusted party manages private ledgers with backed and freezable assets.
The Ripple CTO then criticized why Aave failed to conduct an analysis of whether KelpDAO’s configuration of LayerZero was appropriate for its asset value before accepting Restaked ETH (rsETH) as collateral.
Schwartz on Starting a DeFi Bridging Project for RLUSD
Schwartz’s social media commentary prompted someone to ask him about creating a bridge protocol for RLUSD. The commenter said it would have benefited from lower cost and security.
The Ripple exec answered that it would be a “really hard problem.” He stressed that there should be effective governance for fund decisions, and this is exactly where decentralized models struggle because “nobody knows how to make decentralized governance work when you’re deciding who gets money.”
Furthermore, Schwartz again underscored that LayerZero had “some of the best security tech out there.” But then again, the problem is that it allows issuers to choose whether to utilize such security mechanisms fully.
