Udsen

Security Researcher @OpenZeppelin

[Udsen @Udsen3]

Thrilled to have contributed 2 medium findings (1 solo) to the @code4rena @MoonwellDeFi contest. 🚀 This marks my first top 5 finish in a @code4rena contest. A big thank you to @code4rena for this incredible opportunity! 🙏

[Code4rena @code4rena]

Awards have been announced for the $100,000 USDC @MoonwellDeFi audit 🤝

Top 5:
🥇 @0ximmeas - $15,362.75 USDC
🥈 @0xT1MOH - $12,924.20 USDC
🥉 @kankodu - $7,526.15 USDC
🏅 Udsen - $7,101.78 USDC
🏅 0xWaitress - $5,746.14 USDC (1/2)

[OpenZeppelin @OpenZeppelin]

OpenZeppelin is bringing its security standard to @CantonNetwork

We're building a secure contracts library, reference implementations, and developer tooling for Canton's privacy-first ecosystem, engineered for the most critical institutional use cases.

[OpenZeppelin @OpenZeppelin]

Recent posts by Manuel Aráoz on AI and DeFi security have been widely circulated, and customers have asked whether they reflect OpenZeppelin's position. They do not.

Manuel co-founded OpenZeppelin and served as the company’s CTO until 2019 when he left the company.

[Charles Guillemet @P3b7_]

Two days ago, Kelp DAO suffered a $292 million exploit, the largest DeFi hack of 2026. The attack is elegant in its simplicity, terrifying in its implications, and a case study in how a single misconfiguration can cascade through the entire DeFi stack.

▶ The Setup
Kelp is a liquid restaking protocol. It creates rsETH -- a liquid token representing ETH restaked on EigenLayer. DeFi being DeFi, users want these tokens available across multiple chains. So Kelp uses LayerZero, a cross-chain messaging protocol, to bridge rsETH between networks.

The core idea behind any cross-chain bridge is straightforward:
- A user locks (or burns) tokens on Chain A
- An oracle observes and verifies that transaction
- The bridge mints an equivalent amount of tokens on Chain B
LayerZero's oracle mechanism is its Decentralized Verifier Network (DVN), a set of independent verifiers that must agree a cross-chain message is legitimate before it is executed.

The critical word here is "independent." And that's where things went wrong.

▶ The Vulnerability
For reasons that remain unclear, Kelp had configured a 1-of-1 DVN setup. One verifier. No redundancy. No independent confirmation. LayerZero had explicitly warned against this configuration. Kelp ignored the warning.

A single point of failure in a system securing hundreds of millions of dollars.

▶ The Attack
The attackers, preliminarily attributed to North Korea's Lazarus Group, didn't need to break any smart contract. They went after the infrastructure layer.

To verify blockchain state, a DVN relies on RPC nodes, the servers that synchronize and serve blockchain data. The attackers compromised two RPC nodes used by Kelp's lone DVN, then launched a DDoS attack against the remaining healthy nodes, forcing failover to the poisoned ones.

From there, it was trivial. The compromised RPC nodes presented a fabricated blockchain state to the DVN, pretending that 116,500 rsETH (~18% of total circulating supply) had been legitimately deposited on the source chain. The DVN, seeing no contradicting signal from any other verifier, approved the message. The attacker retrieved 116,500 rsETH freshly minted on the destination chain.

▶ The Liquidation
The attacker deposited the stolen rsETH as collateral on Aave V3 and Compound V3, then borrowed approximately $236 million in (W)ETH against it. By the time lending protocols reacted, freezing rsETH markets, halting new deposits, restricting withdrawals, the damage was done.

Aave now carries an estimated $177-196 million in bad debt. Its TVL plunged from ~$26.4 billion to ~$17.7 billion as panic withdrawals exceeded $5.4 billion. Whether Aave's safety module can fully absorb the loss remains an open question.

Not the decentralized and trustless ideal we went for... The Deeper Problem
Poisoning a handful of RPC nodes and DDoS'ing a few others was enough to fabricate $292 million out of thin air and erodes trust across the entire DeFi ecosystem. No smart contract exploit. No zero-day. Just a misconfigured verifier and an infrastructure-level attack on the nodes it relied on.

But the root cause runs deeper than Kelp's configuration. The fundamental problem is the trust model. Kelp's bridge, like most bridges and many Layer 2 rollups, relies on oracles reading blockchain state from RPC nodes and attesting that "this thing happened." The security of the entire system reduces to one question: can you trust the nodes feeding data to your verifier?

The Kelp hack proves the answer is no. Not the decentralized and trustless ideal we went for...

There is a fundamentally different approach: validity proofs. Instead of trusting oracles to honestly report what happened on another chain, you require a cryptographic proof, a zero-knowledge proof, that the state transition actually occurred according to the protocol's rules. The verifier on the destination chain doesn't trust any RPC node, any oracle, or any DVN. It checks the math. Either the proof is valid or it isn't.

This is exactly the model ZK rollups use to settle on Ethereum. The L1 doesn't ask an oracle "did these transactions happen?" It verifies a succinct proof that they did.

▶ The Goose That Lays the Golden Eggs
One could argue the attacker showed restraint. With a 1-of-1 DVN, they could have minted any amount, $292 BILLION, if they wanted. There are liquidity arguments (you can only extract what lending markets will let you borrow against) and detection arguments (the larger the mint, the faster the response). But there's a more cynical reading.

The Lazarus Group and similar state-sponsored actors are in a peculiar position. They could mint an amount large enough to collapse the entire DeFi ecosystem. But doing so would kill the very system they profit from. So they calibrate, enough to fund their operations, not so much that the ecosystem loses confidence and collapses. The goose must keep laying.

The DeFi ecosystem likes to talk about trustlessness and decentralization. But when a handful of poisoned RPC servers can drain nine figures and trigger a systemic crisis, we should be honest about where we actually are, and serious about the cryptographic tools that can actually get us there.

Stay safe.

[Udsen @Udsen3]

@thepantherplus Likewise ser, appreciate the convo 🙌

[Udsen @Udsen3]

DevConnect & DSS 2025 was an amazing experience! 🚀
Met so many brilliant people from the community, learned a ton from the events, and the best part was getting to spend time with the OpenZeppelin family. Grateful for all the connections and conversations! 💙✨ #DevConnect #DSS

[OpenZeppelin @OpenZeppelin]

One week after Convergence, the conversations still resonate.

Security, privacy, interoperability, and institutional adoption were brought into focus by leaders across the ecosystem.

Here is the recap video, with full session recordings coming next week.

[OpenZeppelin @OpenZeppelin]

The Balancer v2 exploit highlights how complex protocol evolutions can introduce new risks.

OpenZeppelin audited earlier versions of the v2 codebase, prior to the introduction of the attack vector that was later exploited.

Our analysis and lessons for the community ↓
https://t.co/eMWTW3NVqV

[Udsen @Udsen3]

@spearbit @cergyk1337 Congratulations @cergyk1337 🎉️🎉️

[Udsen @Udsen3]

@giraffe0x @Starknet @GuardianAudits Congrats ser!🫡

[curiousapple @0xcuriousapple]

Just wrapped up a 1.5-week engagement at @GuardianAudits , and it was a success!!
Reviewed SNX-XXX-YYY

This time, we also dug into the web2 parts of the app, including the keeper script.
Found some juicy stuff—major reason kim was all smiles yesterday

Web3 team: @zdravkohristov0 @marqymarq10 @arsen_bt @Udsen3
Our beloved fuzzer: @forkforkdog
Web2 team: @aidank1234 @0xaudron

Real scenes from the field:

[Udsen @Udsen3]

@guy_de @ETHDubaiConf Wow Congratz 🫡

[curiousapple @0xcuriousapple]

just another morning at @GuardianAudits
me and bois trying to break snx's assumptions.

......get me assets 😤

@zdravkohristov0 @arsen_bt @marqymarq10 @Udsen3

[Udsen @Udsen3]

@windhustler @burraSec Congratz ser 🔥

[Udsen @Udsen3]

@0xKemah @cantinaxyz @StoryProtocol Thank you mate!

[Udsen @Udsen3]

Placed 4th in the Low Pot during the @CantinaXYZ @StoryProtocol contest!

Reminder that every achievement counts on the journey. Keep grinding those small wins - they will add up to big things!🙌💪 #web3security #motivation #bugbounty

[Udsen @Udsen3]

@tpiliposian @hexens Good luck ser! 🫡

[Udsen @Udsen3]

@robocopeth @cantinaxyz @StoryProtocol Thank You @robocopeth 🫡

[Udsen @Udsen3]

@arsen_bt @GuardianAudits Appreciate that, @arsen_bt ! Likewise - pleasure working with you 🫡

[Udsen @Udsen3]

For the @StoryProtocol contest, my top 3 learnings were:

1. Infra experience counts: Saw firsthand how valuable understanding core blockchain infrastructure (beyond just Solidity) is becoming for security researchers – definitely a portfolio plus.

2. Balancing focus: Learned the importance of allocating audit time dynamically across diverse codebases (like Solidity vs Go/Cosmos SDK here) based on observed risk/complexity, rather than sticking rigidly to one codebase.

3. Auditing = iterative learning: Reinforced that the key is to keep learning with each audit and focus on clear findings. Experience builds results over time!

[Udsen @Udsen3]

@cantinaxyz @StoryProtocol Thank You 🫡