All about Aave’s new ‘risk framework’ after April’s $290 mln exploit

In response to April’s $290 million KelpDAO rsETH bridge exploit, Aave [AAVE] founder Stani Kulechov has outlined a new risk framework for the protocol.

Taking to X, Kulechov wrote,

Over the past several weeks, Aave has been developing a new risk framework that includes Asset Risk, Bridging Risk, Chain Risk, and advanced automation capabilities for risk management.

The framework sets new guidelines for how Aave evaluates, tracks, and controls risk throughout the protocol.

Once approved, the risk framework will be implemented for all assets and markets. In the upcoming weeks, assets that don’t meet the new standard will be removed from Aave.

Details of the multiple layers—Why is it important?

The framework is designed with four main layers. First, Asset Risk, which includes potential delisting, monitoring, due diligence, and onboarding. Next is Bridging Risk, which establishes security standards for assets that are transferred between chains.

The third layer is Automated Risk Oracles and Monitoring, which offers automated defenses against new threats and ongoing monitoring. Lastly, Chain Risk evaluates a blockchain’s suitability for Aave deployment and establishes the maximum exposure that assets may have on it.

What’s behind this framework being created?

The decision was made following an April exploit in which the LayerZero-powered cross-chain bridge Kelp DAO lost 116,500 rsETH tokens. As the exploiter deposited a sizable amount of the stolen assets into Aave V3, the attack then extended to the Aave protocol.

Meanwhile, Aave’s price declined by 2.16% in the previous day to $60.95. Furthermore, Aave’s TVL also saw a move of over $170 million this week, bringing it to approximately $14.75 billion, as reported by AMBCrypto. That is, however, a significant departure from mid-April levels of over $25 billion.

Final Summary

• Any assets listed on Aave V3, V4, and Aave Horizon will be subject to the new requirements.
• The proposal covers the underlying blockchain, bridge infrastructure, issuer behavior, and ongoing monitoring requirements.