Kelp DAO Restaked ETH (RSETH)

Friendly Forks & Operational Excellence

Two protocols I’m very familiar with, @MoonwellDeFi and @KelpDAO, caught the attention of DeFi this week when an $rsETH market rate oracle from @Chainlink was used to drain a couple million $ of wstETH.

What does this mean and what are the implications?

Oracle 101
1⃣ Market rate oracles use an onchain DEX price of an asset to determine the price.
2⃣ Exchange rate oracles use the underlying collateral of an asset to determine the price.

With a market rate, if DEX liquidity is low, even the smallest swaps can depeg the on-chain price of an asset, allowing for easy manipulation. When that asset is used as collateral to borrow other assets, it can create liquidations or, in this case, a short-term mispricing that allowed someone to borrow more than they should.

With an exchange rate, the underlying collateral determines your health factor, regardless of short-term DEX arbitrage, making borrowing on a lending market much safer.

In general, for derivatives that are

Moonwell was using a delisted market rate feed for a low liqudity and low volume asset, rsETH. It's not even listed on the Chainlink docs page.

The proper implementation would have been to use the exchange rate which is both:

A) Actually listed on the docs page (https://t.co/QFUjNrqBSM)

B) Had absolutely zero issues

See Rory's post here from Discord, which goes into more details about the Balancer exploit that had an effect on the volumes of the delisted market rate feed, and a reminder about standard best practices to not use delisted, low volume, low liquidity feeds in your DeFi protocols.

#CCIP Stats Today 📊
💵 Value Transferred: $38,337,424.34
🪙 Top Sent Token: rsETH – $11,313,529.96
🔄 Transactions: 1632
💰 Fees: $6029.98