How Does Kelp DAO Work?

Hardcoded stETH:ETH 1:1 price oracle

Uses a hardcoded 1:1 rate for stETH rather than a market feed; creates arbitrage opportunity during any stETH depeg event. Flagged by LlamaRisk.

KERNEL insurance staking pool

KERNEL token stakers provide insurance against slashing losses; novel insurance primitive with reflexivity risk if KERNEL price drops during a claim event.

Gain Vaults (agETH) with multi-strategy yield

agETH wraps rsETH into yield-generating vault strategies, creating a 4th derivative layer on top of base ETH staking.

Custom oracle aggregator for rsETH pricing

Custom aggregator combining multiple price sources for the rsETH derivative; adds complexity to the oracle surface.

rsETH liquid restaking token

Standard LRT wrapping EigenLayer restaked positions; represents the base derivative layer.

LayerZero OFT bridge for rsETH across 20+ chains

Uses LayerZero's Omnichain Fungible Token (OFT) standard to bridge rsETH across 20+ EVM chains. On April 18, 2026, a configuration weakness in Kelp's DVN/verifier setup allowed the attacker to forge a cross-chain message that minted 116,500 rsETH on a destination chain with no ETH locked on the source. The LayerZero protocol itself was not compromised; the flaw lived in Kelp's endpoint configuration.

During a stETH depeg, the hardcoded 1:1 rate allows arbitrageurs to mint rsETH at inflated value, extracting value from existing holders.

Slashing event triggers insurance claims, selling KERNEL to cover losses; KERNEL price drops, reducing insurance capacity, creating a reflexive death spiral.

4-layer derivative nesting (ETH -> stETH -> rsETH -> agETH) cascades any base-layer slashing event through amplified losses at each derivative layer.

LayerZero's cross-chain messaging accepted a malicious message as valid on April 18, 2026, causing Kelp's bridge to mint 116,500 rsETH (~$292M, 18% of supply) to an attacker wallet funded via Tornado Cash 10 hours earlier. Bridge pauser froze contracts 46 minutes after the drain. Attacker then deposited stolen rsETH on Aave V3 as collateral and borrowed WETH, leaving Aave with $177-200M in bad debt.