![Crypto_Goblinz's tweet photo. The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.](https://pbs.twimg.com/media/HGOHJnbWUAAvHji.jpg)
![Crypto_Goblinz's tweet photo. The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.](https://pbs.twimg.com/media/HGOHJnVW4AAIAXN.jpg)
Olivia
Online
NotYourAverageJoe
@QuantNetworkDev
Technology Maxi $FLR. Hidden gem connoisseur. 🚀
The Inner Circle
Joined December 2021
1K Following
1.2K Followers
20.3K Posts
@SenseiNode hey team, hope you are well! I stake to your node for FlareNetwork. When will the prior period staking rewards be released?
@aucc_official I was staking to @SenseiNode however I received no staking rewards this period. Perhaps I am reading something wrong but it did not appear anything went wrong with their node during that time nor was there any downtime.
@0xQuantic Is the flare team running something like Opus 4.7 xhigh (special software bug hunting tool) as part of normal course of business when creating new code or checking old code?
@HugoPhilion @tedcoin2026 Without exaggeration or hyperbole, in my personal opinion the value proposition of this strategy places the Flare Network in the top five by market capitalization in the entirety of the digital asset space. I think the FLR token, and the team, are the most under valued in crypto.
@HugoPhilion @geek_hub1800 Probably DarkHorse since he likes to retweet scam accounts and mislead people to think it’s actually firelight when it’s not.
1/ XRPFi dominated the news of the week on Flare 🧵
Direct withdrawal of XRP to Flare from exchange. This is such a great use of native XRP functionality, Flares data protocols and the FXRP system.
@IOHK_Charles @HugoPhilion Charles, you can always pivot to making original content on OnlyFans and not copy/paste.
Perhaps doing that will help ADA compete with FLR DeFi #’s.
@andyyy I mean, they can say whatever they want. Onchain data says otherwise. Only trust onchain data.
Congratulations. This is first class functionality.
⚡️ Interesting news:
Permissionless limit orders on all @FlareNetworks, built on top of Enosys DEX V3.
Check the documentation here: https://t.co/358ZvwIj16
All the resources you need for voting on FIP.16 in one place:
Link to vote: https://t.co/99H6R0tJgF
Mechanics and governance overview: https://t.co/g0BelR3tIP
Link to the proposal: https://t.co/pAUlUBcBZP
Video walkthrough:
@SBF_FTX @domgiachetti Can we add an investor top holdings to see what the value would have been if it hadn't been stolen?
@ItsAlwaysZonny Yes, the only obvious solution has been right under all y'all noses @FlareNetworks $FLR.
The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.
![Crypto_Goblinz's tweet photo. The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.](https://pbs.twimg.com/media/HGOHJn3bwAA03r1.jpg)
Most Popular Users
Elon Musk
@elonmusk
240.2M followers
Barack Obama
@barackobama
119.3M followers
Donald J. Trump
@realdonaldtrump
111.6M followers
Cristiano Ronaldo
@cristiano
109M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
97.3M followers
NASA
@nasa
92.1M followers
Justin Bieber
@justinbieber
90.6M followers
KATY PERRY
@katyperry
86.9M followers
Taylor Swift
@taylorswift13
80.7M followers
Lady Gaga
@ladygaga
72.2M followers
Kim Kardashian
@kimkardashian
69.4M followers
YouTube
@youtube
68.6M followers
Virat Kohli
@imvkohli
68.6M followers
Bill Gates
@billgates
63.4M followers
The Ellen Show
@theellenshow
62.5M followers
CNN
@cnn
61.9M followers
Neymar Jr
@neymarjr
61.2M followers
X
@x
60.9M followers
Selena Gomez
@selenagomez
60M followers