Background
On Friday 18 April, an attacker exploited a vulnerability in Kelp DAO’s LayerZero V2 bridge route between Unichain and Ethereum, which allowed unbacked rsETH to be minted on Ethereum mainnet. The incident led to rsETH and WETH freezes on Aave, pushed borrow rates higher across multiple protocols, and caused a wider liquidity crunch in ETH-denominated markets.
At the time of the incident, the CoW DAO Treasury had no direct rsETH exposure. That said, KPK identified contagion risks affecting the stkGHO and SyrupUSDC positions and took precautionary measures. This post provides a full account of the actions taken.
Actions taken
18 April: Mainnet precautionary exits
At 18:54 UTC on 18 April, KPK received an alert regarding suspicious rsETH transfers. By 19:14 UTC, 20 minutes later, the incident was confirmed and KPK began executing precautionary exits on the KPK-managed treasury on mainnet, after identifying contagion risks on stkGHO and SyrupUSDC:
- Activated the stkGHO cooldown and unstaked the position (tx: 1, 2)
- Swapped GHO into USDC via CoW Swap (tx)
- Exited the SyrupUSDC position by swapping into USDC via CoW Swap (tx)
19 April: Gnosis Chain follow-up
The following day, together with the CoW treasury working group, we decided to also withdraw the EURe position on Aave on Gnosis Chain:
- Withdrew the EURe position from Aave on Gnosis Chain (tx)
All actions were executed through the non-custodial Permissions Layer, which defines pre-approved actions for the KPK - treasury management team.
Impact on the CoW DAO Treasury
The rsETH exploit had no material impact on the CoW DAO Treasury. No funds were lost, and the precautionary exits went through successfully and in full.
Resolution and current status
All precautionary exits were completed successfully. The Treasury continues to operate normally.
We continue monitoring the situation across all protocols and will post further updates if any developments affect the Treasury.