KelpDAO has initiated legal action against the interoperability protocol LayerZero in the wake of an approximately $292 million security breach involving its rsETH bridge earlier this year, claiming that vulnerabilities within LayerZero’s security framework helped facilitate the hack.
On Friday, KelpDAO stated that LayerZero neglected to communicate risks associated with its technology and failed to stop malicious actors from breaching its systems. The platform additionally asserted that LayerZero had examined and provided written approval for its setup and configuration prior to the incident.
Furthermore, the legal complaint names Bryan Pellegrino, the co-founder and chief executive officer of LayerZero.
“Our number one priority has always been and will remain the security of our users’ assets,” Kelp wrote. “But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem.”
Pellegrino described the allegations as “groundless” and indicated he intends to contest the lawsuit in Vancouver.
This legal filing intensifies a prolonged disagreement regarding whether the financial loss stemmed from compromised LayerZero infrastructure, KelpDAO’s bridge configuration choices, or a combination of both factors.
Cointelegraph reached out to LayerZero for further commentary but received no reply prior to publication.
Kelp and LayerZero have disputed responsibility since April
The breach on April 18 resulted in the theft of 116,500 rsETH, valued at roughly $292 million at that time, originating from Kelp’s bridge which was powered by LayerZero.
Within its final incident analysis, LayerZero reported that hackers breached its internal nodes, tricking its verifier into accepting a fraudulent cross-chain transmission. The firm contended that the theft succeeded because Kelp’s bridge depended on a single decentralized verifier network (DVN) from LayerZero as its sole validation pathway.
Related: Recovery hopes fade as Kelp DAO hacker launders nearly all $220M in stolen funds
Without requiring a secondary independent verifier, the bridge transferred the rsETH upon receiving validation for the fraudulent message from LayerZero’s verifier. LayerZero mentioned that it had previously advised utilizing multiple DVNs and subsequently altered its policy to stop acting as the mandatory sole verifier for applications.
Kelp has contested LayerZero’s version of events regarding liability. During May, the platform stated that its DVN configuration had been discussed with LayerZero ahead of time and “verified as secure,” while criticizing LayerZero for insufficient hazard warnings. Kelp subsequently revealed intentions to transition the rsETH bridge over to Chainlink’s Cross-Chain Interoperability Protocol.
Magazine: Winners and losers of the SEC’s new tokenized stocks rules
Originally published at https://cointelegraph.com/news/kelpdao-layerzero-lawsuit-rseth-exploit?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound.
