最终修复方案出炉，Aave坏账风波终于要结局了

Original Article: Odaily Planet Daily (@OdailyChina)

Author: Azuma (@azuma_eth)

The Aave bad debt saga that has been unfolding for over a week is essentially coming to a close.

With  DeFi United  having successfully raised sufficient funds to address the issue (having raised 132,704 ETH, worth approximately $302 million as of writing), the Aave team also released a technical implementation plan at midday on April 28 to restore rsETH collateral health and resume normal market operations.

• Odaily Note: For background, please refer to "DeFi Hacked for $292 Million Again – Is Aave No Longer Safe?"; "A $290 Million Hole: The Three-Way Standoff Among Aave, L0, and Kelp"; "Aave Is Handing Over Its DeFi Lending Throne Through Its Own Folly.".

Background Recap

The details of how 116,500 rsETH were stolen from Kelp DAO are less important now than the flow of the stolen funds post-theft.

After succeeding, the hacker distributed the 116,500 rsETH across multiple addresses. A portion was deposited as collateral into Aave V3 on Ethereum mainnet to borrow WETH, another portion was bridged to Arbitrum and used as collateral on Aave there to borrow WETH, while the remaining stolen funds were moved through other channels.

Currently, 7 addresses linked to the hacker still hold active rsETH collateral positions on Aave and Compound, accounting for approximately 107,000 of the original 116,500 stolen tokens.

Proposed Solution

To achieve remediation, Aave outlined a plan with two primary goals. First, to restore the collateral backing of rsETH; second, to clean up the affected positions in lending markets like Aave and Compound, recovering approximately 107,000 rsETH in over-collateralized assets, thereby repairing the market damage.

Let's examine the first goal – restoring the collateral backing of rsETH.

Currently, rsETH is effectively in a state of "insolvency." While the underlying ETH in the staking contracts remains intact, the hacker has drained value via collateralized borrowing. This shortfall has caused the exchange rate peg between rsETH and ETH to break.

Therefore, Aave stated that to restore rsETH's collateral backing, the conversion ratio between rsETH and ETH needs to be brought back to 1:1.07. This will be facilitated by DeFi United, which has now received sufficient ETH commitments to restore full system functionality. However, final execution depends on governance approval, implementation timelines, and the signing of relevant agreements.

If the plan proceeds smoothly, DeFi United will fully restore rsETH's collateral support by depositing ETH into the rsETH bridge lock contract (RSETH_OFTAdapter 0x85d456b2…98ef3). The specific process is as follows:

• Convert DeFi United's ETH into rsETH in batches; 
• Transfer this rsETH into the relevant lock contract; 
• Enable the bridge system to recover safely and resume full operation; 
• LayerZero and Kelp DAO will implement additional security measures to ensure the bridge's safety post-recovery.

Next, consider the second goal – cleaning up affected positions in lending markets.

Once rsETH's collateral backing is restored, theoretically, there should be no bad debt in Aave's lending markets (as collateral value would exceed borrowed value). However, the anomalous collateral positions linked to the hacker still need to be cleared (potentially recovering 13,000 ETH) to resume normal market operations.

To this end, Aave stated it will initiate governance proposals on Ethereum and Arbitrum sequentially to clear these anomalous positions through a "controlled liquidation process." The specific resolution process is:

• Temporarily adjust the rsETH oracle price to trigger efficient liquidation; 
• The liquidation process may temporarily create a shortfall (which will be covered in subsequent steps); 
• Recovered rsETH collateral will be transferred to a multi-sig address managed by DeFi United.

Aave emphasized that these parameter adjustments are temporary measures, solely for restoration execution. All adjustments will be reverted upon completion and will not have a long-term impact on the Aave protocol. During the resolution period, deposits of WETH and rsETH on Ethereum mainnet, Arbitrum, Base, Mantle, and Linea will remain frozen.

The ideal scenario after liquidation is: the rsETH price oracle will be restored; recovered rsETH will be redeemed for ETH via the standard Kelp DAO redemption process; this ETH will be used to cover the shortfalls in Aave's Ethereum and Arbitrum markets. 

As for Compound, a similar cleanup process is expected, with estimated additional recovery of approximately 16,776 ETH, supported by DeFi United's liquidity provisions.

Once both primary goals are effectively achieved, Aave will lift the pause and freeze status on rsETH and ETH in all affected markets and subsequently restore Loan-to-Value (LTV) and other parameter configurations for ETH and other assets.

Outstanding Issues

Aave added that while the above plan is expected to achieve remediation without socialized losses, several uncertainties remain.

First, despite sufficient ETH commitments, fund deployment still relies on final agreements and governance approval; second, clearing affected positions depends on the successful passage and execution of governance proposals; third, deliberate interference by the attacker could prevent the shortfall from fully forming, requiring additional liquidation steps; fourth, while LayerZero and Kelp have deployed additional security measures, residual risks exist before verification in a production environment.

Regardless, the "Kelp DAO Theft, Aave Bad Debt" incident that has troubled the DeFi market for some time appears to be nearing its conclusion. The next step is to observe whether the plan can progress as intended in the live environment.

As The Rollup founder Andy commented: "The next few days are critical for DeFi. The task is Herculean and must be accomplished both quickly and carefully. It's a technical challenge, but more so a test of social coordination. It feels surreal to witness this all unfold in real time."

Let's hope luck is on DeFi's side.