Adam Schoeman

CISO and Ai Czar at @aave

[Adam Schoeman @usintrust]

Can not overstate how happy I am to have Josselin on my team. When Stani and I spoke about doing this I could count the people I could just to do this work on one hand. Having it materialise is just the beginning - expect great things!

[Josselin Feist @Montyly]

Personal update: I am joining @aave

Over the past few months, I have had the chance to work closely with their engineering team. I have been impressed by how they approach security and by their attention to quality

I am excited to continue helping them secure the future of DeFi

[Stani @StaniKulechov]

Aave users will be able to move fiat into Aave through a vertically integrated zero-fee on-ramp, making DeFi more accessible to the mainstream.

The FCA approval in the UK, combined with our CBI MiCA license for the EEA/EU, is a strong addition to our global regulatory strategy.

[Stani @StaniKulechov]

DeFi United has been the largest DAO coordination I've been ever involved, at least 6 different DAOs with governance proposals (Arbitrum, Aave, EtherFi, Lido, Compound and Mantle).

DAOs and coordination sometimes are seen as low velocity, however, when the communities need to step in things are actually moving at high velocity. Kudos for everyone who helped and participated.

[Babylon Foundation @bbn_foundation]

Babylon brings native Bitcoin into DeFi and bringing more Bitcoin into DeFi means supporting in hard moments.

Babylon Foundation will deposit $3M USDT into Aave, with $2M allocated to V3 and $1M to V4, as a show of support and confidence in @aave and DeFi.

Any interest earned from this deposit would be directed back into the Aave ecosystem through Aave x Babylon integration incentives, so the same capital can support recovery now and future adoption later.

We believe DeFi is a core part of the modern financial system. That means competing, building, and rallying with the ecosystem when it needs it.

We’re putting capital behind conviction and our commitment to the @aave ecosystem.

https://t.co/hxMJrYFUnc

[Tay 💖 @tayvano_]

I know a lot of people are going to dive into the weeds on every last detail of this. As they should.

So, I’m just going to remind everyone that these sorts of things are really fucking difficult. The “real” world doesnt do a great job of handling them either. In fact, the real world often does a horrifically shitty, extractive, slow job.

Even for relatively straightforward cases, it can take years for victims to recover any funds.

Once there are multiple entities and impacted individuals involved, you can easily be looking at a decade+.

During that decade, multiple teams of lawyer and accountants will charge top dollar to untangle the mess. They have little at stake in the outcome. Their job is just to untangle. So they do.

This path isn’t required. It’s chosen by the involved parties bc it’s risky to do things.

But there is always risk. It’s risky to NOT do things, too.

As someone who’s worked with victims going thru civil and criminal forfeiture. As well as being involved in a number of more informal situations. And watching Gox…QuadrigaCX…FTX…

It is very rare to get a great outcome from a shitty situation. In the end, most folks are just happy to be done and be able to move on. Even if that means accepting a 12% recovery.

I encourage everyone to keep this the back of their minds when discussing.

It’s easy to shit on any proposal by comparing it to some perfect fantasy you dream up. But that is a fantasy. It’s an impossible state. It can never happen.

You should still push towards this ideal outcome. It’s how you are able to get the best outcome in the end.

But never forget that, at any given point, the most likely outcome is far worse than the one you are railing against and calling shit.

💖

[Adam Schoeman @usintrust]

Inspiring stuff from the community.

[Sam Mason de Caires @sammdec]

While the team and partners finalize other commitments, me, @mark_is_here, @lochieaxon, @alexvanderzon and others spun up a dashboard to track contributions.

Someone also donated defiunited.eth for those wanting to contribute.

Really inspiring to see the community come together on DeFi United.

https://t.co/4cN7h6uKji

[Ethena @ethena]

Ethena has been working closely with affected parties this week in a supporting capacity and is participating with a contribution into @aave's coordinated DeFi relief effort following the rsETH related incident.

As part of a broader recovery initiative alongside other ecosystem participants, Ethena's contribution will go towards restoring the rsETH backing in support of an orderly resolution for stakeholders.

Aavethena.

[ether.fi @ether_fi]

The EtherFi team has been working closely with @aave and other parties to help close the rsETH shortfall following this week's exploit.

The EtherFi Foundation is proposing to contribute 5,000 ETH to the dedicated relief vehicle. This vehicle will protect users and prevent bad debt across DeFi. The Foundation believes a coordinated, ecosystem-wide response is necessary for a proper resolution.

More details below

[Lido @LidoFinance]

A proposal for Lido DAO to contribute to @aave’s coordinated rsETH relief effort has landed on the Research Forum following this week’s Kelp's rsETH LayerZero bridge exploit.

The proposal authorizes a one-time, capped contribution of up to 2,500 stETH to a dedicated relief vehicle, solely as part of a fully funded recovery package. The proposal is designed to reduce broader ecosystem spillover and support an orderly resolution for affected users.

DeFi United. Read more below:

https://t.co/6RsmdW2R6t

[Aave @aave]

Aave service providers have been leading the DeFi United effort to restore rsETH's backing since the April 18 incident.

We believe ecosystem collaboration matters most in moments like this, and our priority is achieving the strongest possible available outcome for users.

Multiple strong indicative commitments are now in place to join this effort toward restoring the backing of rsETH. This includes @LidoFinance, whose contributors have published a proposal today to their DAO to participate in the joint recovery effort.

Lido is one of many partners who are stepping up. We will continue to announce further commitments as they are formalized.

[Stani @StaniKulechov]

The past few days have been intense, but I wanted to give some updates as we continue to work on this. Our priority is our users, and every decision we are making is aimed at an orderly return to normal market conditions and the best possible outcome for everyone involved.

Working around the clock, the team has made progress on multiple paths forward with several partners. The Arbitrum Security Council also recovered $70 million in ETH, which could meaningfully reduce the potential exposure, and multiple discussions and solutions are being considered. I am confident we will move towards a strong resolution.

Reviewing what happened and learning from it matters. But pointing fingers is not something that gets us to the other side of this.

Every bit of my energy right now is focused on the outcome for Aave users and the protocol. Aave has been my life's work, and this is an important moment for DeFi as much as it is for Aave. I am deeply grateful for the support and collaboration we have received from builders and partners across the industry.

We’ll get through this together and we’ll continue to publish updates on @aave as they happen.

[Aave @aave]

Update on rsETH incident:

@LlamaRisk has published a report outlining the rsETH incident, the immediate actions taken, its impact on Aave, and potential paths forward.

All service providers have been working to assess the two potential bad debt scenarios on the Aave protocol.

Aave DAO service providers are also leading an effort with ecosystem participants to address any bad debt. This effort already has several indicative commitments from various parties and we are grateful for the strong support we have received so far.

We will share further updates as we have them.

In the meantime, the full report can be read here: https://t.co/jy3BHZCa7b

[Aave @aave]

Aave Labs has introduced Aave Checkpoint, a tool used to review governance proposal code and data before execution.

For new proposals or payloads, it fetches the onchain data, cross-references parameters against the forum spec, and runs security checks.

[Adam Schoeman @usintrust]

I also wrote about this in our SOC 2 announcement (https://t.co/gfi82u8suZ) but the importance of traditional security cannot be understated.

[Stani @StaniKulechov]

In light of recent DNS attacks, it is clear how important it is to invest in application and ICT security.

Web2 security is often easily overlooked in DeFi, and this is an area where much more attention is needed.

Serious DeFi projects should aim to establish application security teams, appoint CISOs, and meet SOC 2 standards and beyond.

At Aave Labs, we recognized the expansion of this attack surface and have been investing in application security over the past few years.

[Adam Schoeman @usintrust]

This is the final post in this thread.

[Adam Schoeman @usintrust]

1/5 We have spoken a lot about the Secure by Design stance we took with Aave V4; from early engagement with security partners to multiple rounds of audits. But SOC 2 Type II highlights our continued stance and commitment to the other side of cyber security.

[Aave @aave]

Aave Labs achieved SOC 2 Type II attestation across the Trust Services Criteria of Security, Availability, and Confidentiality.

The audit confirms enterprise-grade development and operational standards across all software.

[Adam Schoeman @usintrust]

5/5 My team at Aave Labs, and every employee for that matter lives and breathes security first. Thank you to everyone who had to decide that in order maintain this high watermark we need to sacrifice speed for quality.