![Crypto_Goblinz's tweet photo. The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.](https://pbs.twimg.com/media/HGOHJnbWUAAvHji.jpg)
![Crypto_Goblinz's tweet photo. The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.](https://pbs.twimg.com/media/HGOHJnVW4AAIAXN.jpg)
Olivia
Online
NotYourAverageJoe
@QuantNetworkDev
Technology Maxi $FLR. Hidden gem connoisseur. 🚀
The Inner Circle
Twitter'a katıldığı tarih December 2021
1K Takip Edilen
1.2K Takipçi
20.3K Gönderi
@SenseiNode hey team, hope you are well! I stake to your node for FlareNetwork. When will the prior period staking rewards be released?
@aucc_official I was staking to @SenseiNode however I received no staking rewards this period. Perhaps I am reading something wrong but it did not appear anything went wrong with their node during that time nor was there any downtime.
@0xQuantic Is the flare team running something like Opus 4.7 xhigh (special software bug hunting tool) as part of normal course of business when creating new code or checking old code?
@HugoPhilion @tedcoin2026 Without exaggeration or hyperbole, in my personal opinion the value proposition of this strategy places the Flare Network in the top five by market capitalization in the entirety of the digital asset space. I think the FLR token, and the team, are the most under valued in crypto.
@HugoPhilion @geek_hub1800 Probably DarkHorse since he likes to retweet scam accounts and mislead people to think it’s actually firelight when it’s not.
1/ XRPFi dominated the news of the week on Flare 🧵
Direct withdrawal of XRP to Flare from exchange. This is such a great use of native XRP functionality, Flares data protocols and the FXRP system.
@IOHK_Charles @HugoPhilion Charles, you can always pivot to making original content on OnlyFans and not copy/paste.
Perhaps doing that will help ADA compete with FLR DeFi #’s.
@andyyy I mean, they can say whatever they want. Onchain data says otherwise. Only trust onchain data.
Congratulations. This is first class functionality.
⚡️ Interesting news:
Permissionless limit orders on all @FlareNetworks, built on top of Enosys DEX V3.
Check the documentation here: https://t.co/358ZvwIj16
All the resources you need for voting on FIP.16 in one place:
Link to vote: https://t.co/99H6R0tJgF
Mechanics and governance overview: https://t.co/g0BelR3tIP
Link to the proposal: https://t.co/pAUlUBcBZP
Video walkthrough:
@SBF_FTX @domgiachetti Can we add an investor top holdings to see what the value would have been if it hadn't been stolen?
@ItsAlwaysZonny Yes, the only obvious solution has been right under all y'all noses @FlareNetworks $FLR.
The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.
![Crypto_Goblinz's tweet photo. The KelpDAO exploit (~$290M, is NOT a LayerZero protocol bug. It's a configuration issue and a case study every project with a cross-chain token needs to look at today.
KelpDAO shipped their rsETH OFT with a 1/1 DVN security stack. One required verifier. Zero optional. Threshold 0. Straight from LayerZero Scan's ReceiverOAppConfig on the rsETH bridge pathway:
• requiredDVNCount: 1
• requiredDVNNames: [LayerZero Labs]
• optionalDVNCount: 0
• optionalDVNThreshold: 0
Source and Destination OApp both labeled "Kelp DAO." Destination is the rsETH OFT Adapter on Ethereum: 0x85d456B2DfF1fd8245387C0BfB64Dfb700e98Ef3.
How the attack worked: the forged message's source packet was never actually emitted on the source chain (Unichain). The single required DVN signed an attestation for something that didn't exist and because it was the ONLY required DVN, there was no independent verifier to contradict it. Everything downstream then executed exactly as designed: commitVerification → lzReceive → peer check → OFT decode → rsETH mint. The contracts weren't broken. The verification layer was. One signature and 116,500 rsETH materialized out of thin air on Ethereum.
To be clear: LayerZero V2 is modular by design. Apps pick their own security stack X-of-Y-of-N, multiple independent DVNs, thresholds, block confirmations. No one is forced into any configuration. The protocol gave projects the full toolkit. KelpDAO chose 1/1.
Even reputable DVNs can have a bad day key compromise, infra failure, bad actor, whatever. That's exactly why you want multiple independent verifiers. Redundancy is the whole point. A 1/1 DVN is the cross-chain equivalent of a 1-of-1 multisig on a treasury.
Baseline for any OFT/OApp with serious TVL:
• Multiple required DVNs (3–4+)
• Independent providers (don't stack correlated risk) use canary DVN as it’s also its own independent client.
• Optional DVNs + threshold on top
• Sane block confirmations
If you're a founder or dev with an OFT live in production, pull your Send/Receive ULN config today. Call getConfig() on the endpoint. If requiredDVNCount is 1 and optionalDVNCount is 0, reconfigure before the market does it for you.
Anyone can verify any OApp's config on https://t.co/ovbUskeFCC right now.
Security is the application's responsibility. LayerZero hands every project a powerful, modular security stack it's on the project to actually use it. Kelp's full RCA is still coming, but the root enabler is already onchain and visible to anyone who looks.
Check your configs. Stay safe out there.](https://pbs.twimg.com/media/HGOHJn3bwAA03r1.jpg)
Sotwe'de En Son Ziyaret Edilenler
Share trai siêu đẹp
Son görüldüğü yer Vietnam
Peagade
Son görüldüğü yer Germany
Tobrut
Son görüldüğü yer Indonesia
𝕂𝕀𝔹𝔸𝕆 𝕂𝔸𝕋𝔸 🥁🇹🇿
🌈Gay Miền Tây🌈
Son görüldüğü yer Vietnam
LN
Son görüldüğü yer India
Canlı Yayın İFŞA
🍓
Son görüldüğü yer Germany
khai kmmio
Son görüldüğü yer Indonesia
STUMPY💯
Son görüldüğü yer France
Senin İçin Trendler
En Popüler Kullanıcılar
Elon Musk
@elonmusk
240.2M takipçi
Barack Obama
@barackobama
119.3M takipçi
Donald J. Trump
@realdonaldtrump
111.6M takipçi
Cristiano Ronaldo
@cristiano
109M takipçi
Narendra Modi
@narendramodi
107M takipçi
Rihanna
@rihanna
97.3M takipçi
NASA
@nasa
92.1M takipçi
Justin Bieber
@justinbieber
90.6M takipçi
KATY PERRY
@katyperry
86.9M takipçi
Taylor Swift
@taylorswift13
80.7M takipçi
Lady Gaga
@ladygaga
72.2M takipçi
Kim Kardashian
@kimkardashian
69.4M takipçi
Virat Kohli
@imvkohli
68.6M takipçi
YouTube
@youtube
68.6M takipçi
Bill Gates
@billgates
63.4M takipçi
The Ellen Show
@theellenshow
62.5M takipçi
CNN
@cnn
61.9M takipçi
Neymar Jr
@neymarjr
61.2M takipçi
X
@x
60.9M takipçi
Selena Gomez
@selenagomez
60M takipçi