[ARFC] Add rsETH to Aave V3 Ethereum

[ACI]

Title: [ARFC] Add rsETH to Aave V3 Ethereum

Author: ACI (Aave Chan Initiative)

Date: 2024-08-12

---

ARFC has been updated with Risk Parameters provided by both Risk Service Providers after having reservations with exchange rate oracles. 2024-08-12

ARFC has been updated again after new review by Risk Service Providers 2024-11-11

Summary

Kelp DAO is seeking community support for adding its Liquid Restaking Token, rsETH, to Aave V3 on Ethereum. In addition, rsETH depositors into Aave will accumulate additional Kelp miles and EigenLayer points.

Motivation

KelpDAO (Liquid restaking | Restake ETH or LSTs, mint rsETH and earn Kelp Miles!) is one of the largest liquid restaking protocol built on top of the Eigen Layer. Restakers on Kelp get access to multiple benefits like restaking rewards, staking rewards and DeFi yields.

Latest stats:

• USD 800 Mn+ (~270k Eth) TVL
• 20K+ restakers onboarded
• Accepts ETHx, stETH, sfrxETH, and Native ETH as collateral
• Live across mainnet and L2s such as Arbitrum and Polygon zkEVM

KelpDAO has undergone multiple security audits by top tier audit firms including Sigma Prime, Code4rena. More about KelpDAO’s security here: Kelp DAO Audit reports.

The motivation for this proposal is to introduce a new asset class LRT (Liquid restaking tokens) to Aave and add to the diversity of LST/ LRT category.

Restaking Innovation

KelpDAO’s innovation in the restaking ecosystem has been focused on bringing about the following benefits to users and services-

• Restakers
  • Liqudity for restaked assets (stETH, ETHx, sfrxETH and Native ETH)
  • Access to additional staking rewards
  • Participate in DeFi using rsETH
• AVSs
  • Bootstrap economic security
  • Lowered incentive spends
• Operators
  • Higher revenue earning potential
  • Service onboarding and community support
  • Marketing for node delegation

Specification

> Risk Parameters have been provided by Risk Service Providers on 2024-08-09 and ARFC has been updated. It is recommended listing rsETH using an exchange rate oracle.

Parameter	Value
Isolation Mode	No
Borrowable	Yes
Collateral Enabled	Yes
Supply Cap	19,000
Borrow Cap	1,900
Debt Ceiling	-
LTV	72%
LT	75%
Liquidation Penalty	7.5%
Liquidation Protocol Fee	10.00%
Variable Base	0.0%
Variable Slope1	7.00%
Variable Slope2	300.00%
Uoptimal	45.00%
Reserve Factor	15.00%
Stable Borrowing	Disabled
Flashloanable	Yes
Siloed Borrowing	No
Borrowable in Isolation	No
E-Mode Category	rsETH-Correlated

CAPO

maxYearlyRatioGrowthPercent	ratioReferenceTime	MINIMUM_SNAPSHOT_DELAY
9.83%	monthly	14 days

2024-11-01
Based on the considerations outlined above, we recommend implementing the following E-Mode configuration:

rsETH/wstETH/ETHx

Parameter	Value	Value	Value
Asset	rsETH	wstETH	ETHx
Collateral	Yes	No	No
Borrowable	No	Yes	Yes
Max LTV	92.5%	-	-
Liquidation Threshold	94.5%	-	-
Liquidation Penalty	1.00%	-	-

	Current Borrow Cap	Recommended Borrow Cap
wstETH	48,000	60,000
ETHx	320	5,000

Detailed explanation on Kelp’s technical architecture - Technical Architecture - Kelp

KelpDAO will have its own token $Kelp that will be the main governance token of Kelp protocol. Kelp token holders will be able to participate in governance related matters including Whitelisting/ delisting of Assets, Node operators, AVS’, setting and updating fees for Kelp protocol.

Kelp’s on-chain stats can be viewed on Dune.

Liquidity Pools for rsETH

Following are liquidity stats for rsETH:

• rsETH has >55 Mn USD liquidity across several DEXs on the mainnet including
  • Balancer - $38 Mn
  • Uniswap V3 - $12.42 Mn
  • Balancer - $5 Mn
  • Few others
• ~$10 Mn+ average daily trading volume (Last 7 days on 12th May)

Oracles:

rsETH is supported by Chainlink and Redstone oracles. Posted links below to the Oracle contracts:

Chainlink calculated price feed: Kelp DAO: Chainlink Price Oracle (0x78C12ccE8346B936117655Dd3D70a2501Fd3d6e6) | Address 0x78C12ccE8346B936117655Dd3D70a2501Fd3d6e6 | Etherscan

Chainlink market feed: RSETH / ETH Price Feed | Chainlink

Redstone market feed:

https://app.redstone.finance/tokens#/app/token/rsETH\\ETH

rsETH exchange rate mechanism:

rsETH exchange rate is defined based on the underlying assets and rewards generated by those assets.

Accepted assets include ETH, stETH, ETHx, sfrxETH.

Exchange rate calculation -

A → Total ETH + Staking rewards accumulated from the chain

B → [Amount of ETHx] * [Value of 1 ETHx in ETH]

C → [Amount of sfrxETH] * [Value of 1 sfrxETH in ETH]

D → [Amount of stETH] * [Value of 1 stETH in ETH]

E → Total supply of rsETH

Exchange rate (rsETH / ETH) = [A + B + C + D] / E

Withdrawals and risks

Prior to this ARFC, the only way to exit rsETH was via DEXs.

Nevertheless, KelpDAO users can now unstake rsETH, with an unbonding period of 7 to 8 days, due to Eigenlayer withdrawal period. That also means that any of the LST’s including stETH, ETHx or sfrxETH from Eigenlayer can be unstaked as well.

Proof of Liquidity and Deposit Commitments:

Anyone who deposits rsETH into Aave will accumulate additional Kelp miles and EigenLayer points.

Useful Links:

• KelpDAO’s Dapp
• Contract Address: 0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7
• GitHub Docs

Disclaimer:

This proposal is powered by Skywards. The Aave Chan Initiative is not directly affiliated with Kelp DAO and did not receive compensation for creation this proposal.

Next Steps

1. Publication of a standard ARFC, collect community & service providers feedback before escalating proposal to ARFC snapshot stage
2. If the ARFC snapshot outcome is YAE, publish an AIP vote for final confirmation and enforcement of the proposal

Copyright:

Copyright and related rights waived under CC0

[ChaosLabs]

Overview

Chaos Labs supports listing rsETH on Aave V3 Ethereum as part of the community’s strategy to increase the offering of Aave protocol with more LST/LRT assets. Following is our analysis and risk parameter recommendations for the initial listing.

Note: The following analysis is conducted solely from a market risk viewpoint, excluding centralization and third-party risk considerations. If the community aims to reduce exposure to rsETH, adopting more conservative supply and borrow caps should be considered.

Liquidity and Market Cap

The amount of ETH restaked with Kelp DAO has grown rapidly, from 65K ETH in mid-January to 255K ETH today. Note that withdrawals were opened on May 4, 2024, which led to a 10K ETH decrease in TVL.

Currently, users may stake using ETHx, WETH, stETH, or sfrxETH. Rewards are reflected in the price of the token rather than rebasing. Since inception, it has registered $6.67M in average daily volume.

On Ethereum, its liquidity is concentrated on Balancer V2 ($38M TVL, paired with WETH) and Uniswap V3 ($14M TVL, paired with WETH).

rsETH / ETH Volatility

Liquidation Threshold

Considering the volatility and the correlation of rsETH to ETH, we recommend setting the LT to 75%, mirroring weETH on Ethereum V3.

Supply Cap, Borrow Cap, and Liquidation Bonus

Chaos Labs’ approach to initial supply caps is generally proposed through setting the Supply Cap at 2x the liquidity available under the Liquidation Penalty (7.5%) price impact, which leads us to recommend a starting supply cap of 8,000 rsETH.

Based on our observations, the utilization rate for LRTs and LSTs has been low due to additional borrowing costs. Therefore, we have taken a conservative approach and recommend a borrow cap of 800 rsETH. However, if there is a significant increase in demand and utilization, perhaps due to external incentives, we will reassess the caps according to the utilization pattern.

IR Curve Parameters

We recommend aligning the interest rate parameters with those of weETH on Ethereum to ensure consistency across similar assets on Aave v3.

Oracle Setting and E-mode

Following analysis, we find that rsETH has consistently traded below the reward-adjusted ETH price implied by its exchange rate. This persistent discount has been punctuated by periods of a widening discount, reaching nearly 3% in March and breaching 2% in April. The limited history since withdrawals were enabled shows that the discount remains, albeit with less severe spikes.

Given these factors, we first recommend utilizing the market price when listing this asset and not a calculated price feed. Additionally, we do not recommend listing this asset in E-Mode, given its tendency to face wide discounts, which could spark liquidation cascades in a highly leveraged market using a market oracle price. Below are our updated specifications.

Recommendations

Following the above analysis, we recommend listing rsETH with the following parameter settings:

Parameter	Value
Isolation Mode	No
Borrowable	Yes
Collateral Enabled	Yes
Supply Cap (rsETH)	8,000
Borrow Cap (rsETH)	800
Debt Ceiling	-
LTV	72.50%
LT	75.00%
Liquidation Bonus	7.50%
Liquidation Protocol Fee	10.00%
Variable Base	0.0%
Variable Slope1	7.00%
Variable Slope2	300.00%
Uoptimal	45.00%
Reserve Factor	15.00%
Stable Borrowing	Disabled
Flashloanable	Yes
Siloed Borrowing	No
Borrowed in Isolation	No
E-Mode Category	N/A

CAPO recommendations:

maxYearlyRatioGrowthPercent	ratioReferenceTime	MINIMUM_SNAPSHOT_DELAY
8.75%	monthly	7 days

[MarcZeller]

Before the escalation of this proposal, I would like to request an Oracle evaluation about the rsETH pricing model.

I’m yet to be convinced an Index approach is safe; we currently have large growth and “infinite” demand with weETH, and we thus have the luxury to be conservative with other LRTs even if diversity is appreciated.

[zmanian]

Hello Aave community, Zaki, cofounder of Sommelier

Sommelier is working with Kelp on a deeper vault integration with Kelp that would make extensive use of Aave looping through weth and steth on Aave.

As Sommelier powered vaults have continued to drive a significant amount of utilization on Aave and we would expect there to be a substantial amount of adoption driven by the vault.

[ChaosLabs]

After further analysis of the rsETH price, we have updated our recommendation in the original post above with a recommendation to exclude the asset from E-mode should the community decide on listing the asset.

[LlamaRisk]

LlamaRisk is in favour of @ChaosLabs’s recommendation for cautious onboarding of Kelp’s rsETH, including exclusion from e-Mode (as opposed to weETH and osETH), a limited supply cap of 8,000 rsETH, and a conservative LT of 75%. This recommendation stems from our initial review of rsETH, with a particular focus on its internal exchange rate (probed by @MarcZeller), and associated dependancies.

We share our preliminary findings below, emphasizing using rsETH market price for its integration with Aave. We are working on a comprehensive assessment of rsETH and will update the Aave community accordingly.

rsETH Exchange Rate Mechanism

The rsETH exchange rate is determined by the underlying assets (ETH, stETH, ETHx, sfrxETH) and the accumulated staking rewards. The LRTOracle contract stores the Oracle contract for each asset.

• stETH (oracle contract): price is hardcoded to 1:1 with ETH.
• ETHx (oracle contract): price relies on the getExchangeRate function of the StaderStakePoolsManager contract, which Stader updates via a permissioned function. The oracle does not independently check for price anomalies or liveness, and it is a proxy contract that the Stader team can upgrade. The getExchangeRate function, operated by Stader, returns a state variable called exchangeRate, updated by the submitExchangeRateData function, callable only by whitelisted addresses controlled by Stader. The ETHx price is determined by the “book value” of ETHx, calculated as totalAssets / totalSupply, similar to the ERC-4626 accounting method.
• sfrxETH (oracle contract): price is obtained from Frax’s sfrxETH pricePerShare function, an ERC-4626 tokenized vault. The price feed assumes frxETH to be 1:1 with ETH.

Market Price vs. rsETH exchange rate

The rsETH exchange rate calculation includes several assumptions, resulting in a considerable spread between the computed exchange rate and the market price of rsETH. This can be seen in the chart below (data from March 8th May 31st):

Source: rsETH internal rate, Redstone & Chainlink feeds and Uniswap V3 rsETH / ETH Pool (blocks 19390000 to 19987000)

Risks with dependencies

The main risk factors associated with rsETH’s dependencies are:

1. sfrxETH/stETH oracle assumptions: If the market price of stETH or frxETH falls below the ETH price, the collateral backing rsETH could be worth less than expected by the rsETH system. This could lead to a depreciation in the market price of rsETH.
2. ETHx oracle centralization: The ETHx price is obtained from a relatively centralized source. If a malicious actor manipulates the price feed, they could unjustly inflate the rsETH supply up to the ETHx deposit limit.
3. LRTManager permissioned function: The Kelp External Admin (6/8) is whitelisted as the LRTManager, which can updatePriceOracleFor without a timelock. This centralization could lead to mistakes or malicious actions that could brick the protocol or cause a loss of funds. For example, adding a new supported token requires calling three different functions in a specific sequence. If the calls are contained in other transactions, the protocol could be in an intermediate state, blocking the updateRSETHPrice() function.

[LlamaRisk]

Collateral Risk Assessment - Kelp DAO Restaked ETH (rsETH)

LlamaRisk conducted a comprehensive collateral risk assessment on rsETH, which can be read here. Our findings are generally favorable, with the Kelp team being receptive to our feedback and implementing several beneficial changes. These include displaying the 10% ETH staking reward fee and underlying breakdown on the UI and committing to implementing a bug bounty program.

We recommend onboarding rsETH with the earlier parameters: exclusion from e-Mode (as opposed to weETH and osETH), a limited supply cap of 8,000 rsETH, and a conservative LT of 75%. rsETH liquidity has increased an estimated 42% across different venues since our first assessment in late May 2024, and we perceive its risk as lesser now.

Below are the highlights of our research, supporting our recommendation. This recommendation is contingent upon implementing a bug bounty program, which we deem crucial and has been scheduled to go live in the coming days.

Risk Management summary

This section will summarize the report’s findings by highlighting the most significant risk factors in the three categories: Market Risk, Technology Risk, and Counterparty Risk.

6.1.1 Market Risk

LIQUIDITY: Does the LSD have a liquid market that can facilitate liquidations in all foreseeable market events?

The on-chain liquidity for rsETH is relatively good, with multiple integrations and liquidity venues. The minted rsETH is also relatively spread out among wallets and protocols, with no single EOA concentrating a significant portion of the supply. Top holders include LayerZero, a Zircuit re-staking pool, and a Pendle rsETH fixed-rate market. Liquidity pools with rsETH are either paired with WETH, ETH, ETHx from Stader, or weETH from EtherFi.

VOLATILITY: Has the LSD had any significant depeg event?

The rsETH/ETH secondary market rate has consistently traded at a small discount compared to the protocol’s internal exchange rate. However, the peg has recently improved due to the addition of ETH withdrawals and a reduced withdrawal delay from 7 to 2 days. The only significant depeg event was a -1.5% deviation in late April, which quickly corrected. Notably, as rsETH is partially backed by LSDs, its exchange rate with ETH would be affected by any LSD depeg. This is an inherent characteristic of an LRT backed by LSDs, not a fault of Kelp. By using the internal exchange rates of LSDs, KelpDAO provides rsETH/ETH with a more stable exchange rate.

6.1.2 Technology Risk

SMART CONTRACTS: Does the analysis of the audits and development activity suggest any cause for concern?

KelpDAO has conducted three audits on its codebase from renowned auditors. Although no serious flaws were revealed, some fixes were made. The codebase is public on GitHub, well-documented, and shows professional development practices. However, online development activity is limited to a few commits; no PRs or tagged releases are visible. A Code4rena audit competition allowed anyone to disclose vulnerabilities, but the total reward was limited to $28k, which is low compared to industry standards. Kelp has stated that a bug bounty program will be implemented shortly, which we consider crucial before onboarding.

DEPENDENCIES: Does the analysis of dependencies (e.g., oracles) suggest any cause for concern?

KelpDAO directly depends on the internal exchange rates of ETHx and uses a hardcoded exchange rate of 1 for stETH. While beneficial for exchange rate stability, this could enable an arbitrage attack if one of the supported LSDs were to depeg. The KelpDAO team has provided a mitigation strategy, but it remains imperfect and could still result in a net loss for KelpDAO users in some cases. The implementation of a circuit breaker should improve this issue. The rsETH/ETH exchange rate, used for deposits and withdrawals, relies on the price of its underlying assets.

KelpDAO also relies on off-chain services for some aspects of the protocol. These services operate through an EOA whose private keys are stored in an AWS secret manager, authenticated using a role-based access control system. Although no funds can be stolen if the private keys leak, a more robust and secure approach is warranted. A decentralized set of off-chain services with an on-chain threshold consensus could enhance reliability and security.

6.1.3 Counterparty Risk

CENTRALIZATION: Are there any significant centralization vectors that could rug users?

KelpDAO remains very centralized, with the development team having significant power over contract upgrades, protocol parameters, and total control over the off-chain services needed for minting and withdrawals to work correctly. There is no DAO nor governance tokens. Communication mediums for users exist, including Twitter, Telegram, and Discord, but they mostly serve marketing and support purposes. However, a role-based access control system and two different multisigs, along with a timelock with a 10-day delay for contract upgrades, provide a solid foundation upon which more decentralization should be built.

LEGAL: Does the legal analysis of the Protocol suggest any cause for concern?

Kelp’s Terms of Service require users to self-acknowledge compliance with sanctions and ensure their funds are not linked to illegal activities. However, Kelp does not enforce access restrictions at the user interface level. Users must confirm they are not sanctioned or from sanctioned regions and agree not to use Kelp for unlawful purposes. Kelp may conduct “Know Your Customer” and “Anti-Money Laundering” checks and terminate services if users provide false information.

Advertised as a non-custodial protocol—even though the protocol is relatively centralized with the team having control over it — KelpDAO claims that users are fully responsible for their digital assets and wallet security, with Kelp bearing no liability for third-party services or issues arising from wallet use. While the terms of services are clear, the Panama incorporation results in a lack of regulatory clarity.

Risk Rating

The following chart summarizes a risk rating for rsETH as collateral based on the risks identified for each category. The rating for each category is ranked from excellent, good, ok, and poor.

• We rank rsETH good in liquidity for the many liquidity venues that provide it. The existence of DEX pools paired with ETHx, based on the team’s relationship with Stader, is a plus.
• We rank rsETH good in volatility because the quality of its peg has increased consistently. The only depeg event was short-lived and limited in strength.
• We rank rsETH ok in smart contracts because of the limited number of issues in the three publicly available audit reports. The code source is public, well-documented, and professional. However, the lack of a bounty is a significant issue, given the importance of TVL.
• We rank rsETH poor in dependencies because of using a fixed exchange rate for stETH and internal exchange rates for ETHx, potentially socializing specific asset risks between all depositors. The lack of transparency regarding off-chain services is also a cause for concern. Although essential to the correct operation of the protocol, they are operated in a centralized way through EOAs.
• We rank rsETH ok in decentralization because the team still has significant control over the protocol, and there is no clear path to decentralization. Validators are trusted by three professional node operators, which is good but could be greater. The role-based access control system, the multisigs, and the Timelock are positive.
• We rank rsETH good in legal for establishing a fully compliant legal structure in the Panama Islands. Although user terms are clear, there still needs to be regulatory clarity from Panama’s securities laws.

Source: LlamaRisk comparative chart

Although KelpDAO has taken positive strides in making rsETH a suitable collateral asset, we generally advise caution when assuming exposure to any liquid restaking token. The sector remains highly speculative, driven by points programs that may lead to rapid shifts in demand for the asset, potentially resulting in sustained depeg events. LRTs are generally a less mature asset class with substantial centralization vectors and reliance on off-chain services that often involve processes overseen by the protocol team.

We advise that KelpDAO must address concerns critical to its security and transparency before being considered for collateral onboarding. We have been working with the KelpDAO team to resolve what we consider blockers. Their team has been receptive and has committed to addressing these points.

• Implementing a bug bounty program is urgently needed given the protocol’s high TVL, and any delay poses significant risks.
• KelpDAO’s communication needs improvement, particularly regarding changes like the unannounced removal of sfrxETH.

In addition to immediate blockers, we await the transition to a fully decentralized DAO structure, which should be expedited to ensure proper governance and community involvement and reduce reliance on off-chain services. Progressive decentralization is a common theme for many LRTs and DeFi protocols generally, but the current centralized management level highlights the protocol’s immature state.

After addressing the two primary points described above, we advise a conservative approach to onboarding with low exposure limits, conservative LT parameters (exclusion from e-mode in Aave, for instance), and a gradual onboarding process that matches the protocol’s maturity over time.

[Agvs]

Thanks Llama team for the assessment on Kelp’s rsETH. Addressing the immediate concerns below:

1. Bug Bounty program launch is in the final stages of review by legal and expected to be launched in a few days. Will update this with the actual program once it goes live.

2. Changes related to sfrxETH have already been posted here informing the community: Update for sfrxETH deposits on Kelp DAO | by Kelp DAO | Jul, 2024 | Medium

Will have a detailed response on the others soon.

[DheerajBorra]

Hi! Dheeraj from Kelp DAO here.

Bug bounty program for Kelp DAO is live on Immunefi - Kelp DAO Bug Bounties | Immunefi | Immunefi

[ChaosLabs]

Following the changes mentioned above, Chaos Labs recommends listing rsETH using an exchange rate oracle. We provide updated parameters, including a CAPO recommendation, below.

Analysis

At the time of our previous recommendation on May 16, withdrawals had just begun, and rsETH still faced a wide discount relative to its reward-adjusted ETH price. Because of this, we recommended using a market rate oracle, as well as excluding the asset from E-Mode.

However, ongoing withdrawals have proved beneficial to rsETH’s peg, decreasing from just under 100bps at the time of writing to 35bps now. Despite a temporary depeg during the August 4 crash, it has proved to mean revert quickly.

There were previous concerns regarding rsETH’s exchange rate model, which uses index pricing based upon the underlying assets. Following the removal of sfrxETH from rsETH’s backing, we note that the derivative assets underlying rsETH’s exchange rate — ETHx and stETH — are both included on Aave V3 using an exchange rate oracle. Given this, we find limited additional risk associated with listing rsETH using an exchange rate oracle, noting that this will allow the protocol to avoid liquidation cascades during temporary secondary market depegs.

Regarding the recommended supply cap, we have utilized our usual supply cap methodology, setting it at two times the liquidity available beneath the Liquidation Penalty. While rsETH’s supply did decrease following withdrawals opening, we have observed a leveling off in recent weeks.

Additionally, on-chain supply would have to fall to 25.3K rsETH — from 250K rsETH now — to violate the community-agreed rule in which supply caps do not exceed 75% of on-chain supply.

Specification

rsETH

Parameter	Value
Isolation Mode	No
Borrowable	Yes
Collateral Enabled	Yes
Supply Cap	19,000
Borrow Cap	1,900
Debt Ceiling	-
LTV	72%
LT	75%
Liquidation Penalty	7.5%
Liquidation Protocol Fee	10.00%
Variable Base	0.0%
Variable Slope1	7.00%
Variable Slope2	300.00%
Uoptimal	45.00%
Reserve Factor	15.00%
Stable Borrowing	Disabled
Flashloanable	Yes
Siloed Borrowing	No
Borrowable in Isolation	No
E-Mode Category	ETH-Correlated

CAPO

maxYearlyRatioGrowthPercent	ratioReferenceTime	MINIMUM_SNAPSHOT_DELAY
9.83%	monthly	14 days

[LlamaRisk]

We endorse @ChaosLabs’ parameter recommendations, including the ETH-correlated e-mode and the use of an internal exchange rate. We note that there have been no substantial qualitative changes since our last review in late July, except for the implementation of a bug bounty program, which we had strongly advocated for.

[ACI]

After new feedback from Risk Service Providers, the current proposal has been escalated to ARFC Snapshot. It has been included latest risk parameters.

Vote will start tomorrow, we encourage everyone to participate.

[ACI]

In parallel to ARFC Snapshot being opened for vote, an extra analysis from BGD Labs will be provided, in order to be aligned with Adding rsETH to Aave V3 Ethereum.

[ACI]

After Snapshot monitoring, the current ARFC Snapshot recently ended, reaching out both Quorum and YAE as winning option, with 892K votes.

Therefore, the ARFC to Add rsETH to Aave V3 Ethereum has passed.

Nevertheless, as stated in previous comment, an extra analysis from BGD Labs will be provided, before moving the proposal forward.

[bgdlabs]

rsETH (Kelp DAO) technical analysis

Summary

This is a technical analysis of the rsETH asset’s smart contracts and main dependencies.

Disclosure: This is not an exhaustive security review of the asset like the ones done by the Kelp DAO, but an analysis from an Aave technical service provider on different aspects we consider critical to review before a new type of listing. Consequently, like with any security review, this is not an absolute statement that the asset is flawless, only that, in our opinion, we don’t see significant problems with its integration with Aave, apart from different trust points.

Analysis

rsETH is an LRT that accrues rewards from depositing native ETH and LSTs (currently ETHx and stETH) into restaking platforms, such as EigenLayer.

For the context of this analysis, our focus has been on the following aspects, critical for the correct and secure integration with Aave:

• Mechanism to update the exchange rate of the asset for the LST and underlying ETH.
• Access control (ownerships, admin roles) and nature of the entities involved.
• Any miscellaneous aspect of the code we can consider of importance.

General points

• The upgradeability admin of all systems is an OZ Timelock, which has a 10-day time lock and is controlled by a 6-of-8 Gnosis Safe.
• An OZ transparent proxy pattern is used for proxies.

Contracts

The following is a non-exhaustive overview of the main smart contracts involved with rsETH.

rsETH

• The ERC20 token is an OZ Transparent Proxy contract with upgradeability by the general Timelock.
• The mint() and burnFrom() functions are controlled by the LRTDepositPool and LRTWithdrawalManager contracts, respectively.
• The contract can be paused by the Kelp Manager, a 2-of-5 Gnosis Safe, and only unpaused by the Kelp Admin, which is a 3-of-5 Gnosis Safe.
• On L2 chains, the rsETH implements the Omnichain Fungible Token (OFT) Standard by LayerZero, allowing token transfer across multiple chains. It works by burning the token on the initial chain whenever an omnichain transfer is initiated and sending a message (via LayerZero) to the destination contract to mint the same amount.
• On L2s, there is also a wrapped version (wrsETH), which serves as a standard reference point for KelpDAO, as the alt rsETH is basically an OFT Token for cross-chain transfers. The alternative rsETH tokens can be exchanged at a 1:1 ratio for the wrsETH token.

LRTConfig

This contract is the central point for system configurations.: it manages the supported LSTs and their caps and protocol fees.

• It’s an OZ Transparent Proxy with upgradeability by the general timelock.
• The access control is shared between a DEFAULT_ADMIN_ROLE role held by a 6-of-8 Gnosis Safe and a MANAGER not set yet.
• The DEFAULT_ADMIN_ROLE can add assets and their caps configurations by calling addNewSupportedAsset(asset, depositLimit), and it EigenLayer strategy via the updateAssetStrategy(asset, strategy).
• The MANAGER can update the asset caps by calling the updateAssetDepositLimit(asset, depositLimit).

LRTDepositPool

• An OZ Transparent Proxy contract, which is also the only rsETH minter, is the entry point for depositing native ETH and other LSTs.
• Users can mint rsETH with native ETH by calling depositETH and with LSTs (Currently ETHx and stETH) by calling depositAsset
• The exchange rate of rsETH/ETH (rsETHPrice), and others LRTs (assetPrice) are queried from the LRTOracle.
• To calculate the mint amount the getRsETHAmountToMint() function is called, which uses the formula: assetAmount * assetPrice / rsETHPrice.
• The underlying funds are delegated to node operators registered in EigenLayer. Currently, the node operator partners are Kiln, Allnodes, Luganodes and Omakase
• The contract can be paused by the Kelp Manager and only unpaused by the Kelp Admin like the rsETH token.
• The LRT Manager can transfer ETH and LSTs to a node delegator, swap ETH for LSTs lying in the deposit Pool, and pause the Pool.
• The LRT Admin can add and remove node delegators to/from the queue, set the minimum amount to deposit, update the maximum number of node delegators, and unpause the Pool.

LRTWithdrawalManager

• The exit point for withdrawal LSTs is an OZ Transparent Proxy contract, which is also the only rsETH burner. Currently, it’s not possible to withdraw native ETH.
• The withdrawals happen in a 2-step process, where users first call initiateWithdrawal() entering the withdrawal queue, and between 7-10 days (7-day delay imposed by EigenLayer along with the time required by Kelp to execute withdrawals) the LRT operator will redeem the staked assets for the users finally call completeWithdrawal().
• The LRT Admin can set the minimum amount and the delay interval to withdraw, and unpause the Withdrawal Manager contract.

LRTOracle

• OZ Transparent Proxy contract with upgradeability by the general Timelock.
• The exchange rate is updated permissionless by calling updateRSETHPrice(), which is calculated using the formula: staked assets value in ETH / rsETH supply.
• To calculate the staked assets value in ETH is queried each staked asset amount from the depositPool by calling getTotalAssetDeposits(), which returns the amount among the Deposit Pool, Node Delegator Contracts, and EigenLayer, then is multiplied by its exchange rate (for LSTs) or 1 (for native ETH).
• The getTotalAssetDeposits() function internally calls the getAssetDistributionData(asset) to obtain the balances via the asset.balanceOf() function instead of virtual balances, meaning that the exchange rate of rsETH can be manipulated by inflating its price via donation of these assets.
• Internally, the updateRSETHPrice() calls a _isNewPriceOffLimit(oldPrice, newPrice) that checks if the price is out of bounds limited by the pricePercentageLimit storage variable, but currently it’s set to zero.

Asset Pricing

After reviewing the system and its exchange rate calculations, our suggestion for pricing is a CAPO rsETH/ETH exchange rate (fetched from the LRT Oracle) + ETH/USD feed.

It’s important to mention that we identified during the analysis that the exchange rate is prone to manipulation by donating LSTs. The system accounts for LSTs lying in the DepositPool contract using balanceOf instead of virtual balances.
However, any risks associated with any possible manipulation of the exchange will be minimized during the listing of this asset, giving the following points:

• The rsETH will be listed as non-borrowable, minimizing any well-known attacks on the borrowing side to zero.
• The primary use case for rsETH will be used as collateral in the new e-mode categories implemented in v3.2.
• Like what was described in ezETH (here), any potential donation is considered an injection of rewards and an actual cost and loss to the attacker. Donating LSTs to increase collateral value and borrow more WETH is unlikely to compensate for the cost of the donation, meaning that the attacker gains little to no benefit from this action.

Disclosure: The price strategy in this analysis accounts for only ETH, ETHx, and stETH (the underlying assets currently composing rsETH), and the Kelp Team has confirmed they are not planning to add new ones in the future.

Miscellaneous

• The system has multiple audits by auditors such as Sigma Prime, C4, and MixBytes. We still recommend adding some extra.
• The 10-day Timelock with the 6-9 multi-sig that upgrades the system is solid, as it gives enough time to check all the functionalities being implemented. However, some permissioned functions like addNewSupportedAsset are still managed via multi-sig, which we think could be managed via the timelock as an extra security layer, because any underlying asset added could directly affect how rsETH is priced on Aave.
  We have recommended the Kelp DAO team to address this.
• The lack of methods to off-board underlying assets from rsETH makes the asset pricing not a straightforward process. For example, off-boarding an underlying asset is only possible by setting its caps to zero. If an underlying asset is removed from rsETH, the system would still account for any amount transferred to the DepositPool contract because it uses balanceOf, meaning the rsETH is wrongly priced.
  We have recommended the Kelp Team to include a function to remove underlying assets from the assets list in the LRTConfig contract so the system would be protected from off-boarded assets lying in the DepositPool contract being accounted in the rsETH price.

Conclusion

From our technical service provider perspective, rsETH seems to have no significant issues with integration into Aave. However, we still have some recommendations, mainly those addressed in Miscellaneous, about how the team manages the onboard/off-board of underlying assets, which would add extra security to this listing.

Additionally, the DAO should be aware that procedures suggested in the asset pricing section must be followed to correct pricing and minimize any risks associated with manipulations.

[ChaosLabs]

Summary

Chaos Labs provides an update to our rsETH listing post to include recommendations for its Liquid E-Mode, along with related parameter adjustments.

Motivation

Prior to Aave v3.2, E-Mode configurations were constrained to the least liquid and stable asset within each E-Mode pool, limiting capital efficiency. Liquid E-Modes now enable more tailored E-Mode configurations, allowing for optimization across different asset pairs. In this case, we provide recommendations for a rsETH E-Mode with wstETH and ETHx as borrowable assets.

Collateral and Borrowable

To prevent same-asset looping, which could undermine the intended use of liquidity incentives and lead to unintended utilization, we recommend configuring rsETH as collateral and wstETH and ETHx as borrowable in the proposed E-Mode.

E-mode LT/LTV

Given that all of these assets carry exchange rates with varying reward distribution techniques, we recommend setting the LTV and LT for rsETH 50 bps lower than the established E-Mode on Aave V3 to account for deviations in exchange rates.

Supply and Borrow Caps

Additionally, we provide updated borrow caps for the assets in question in the Ethereum Core pool, all of which are based on our borrow methodologies and are supported by on-chain liquidity.

Specification

Based on the considerations outlined above, we recommend implementing the following E-Mode configuration:

rsETH/wstETH/ETHx

Parameter	Value	Value	Value
Asset	rsETH	wstETH	ETHx
Collateral	Yes	No	No
Borrowable	No	Yes	Yes
Max LTV	92.5%	-	-
Liquidation Threshold	94.5%	-	-
Liquidation Penalty	1.00%	-	-

	Current Borrow Cap	Recommended Borrow Cap
wstETH	48,000	60,000
ETHx	320	5,000

Disclaimer

Chaos Labs has not been compensated by any third party for publishing this recommendation.

[ACI]

[ARFC Addendum] Onboard rsETH to Lido Instance

Author: ACI

Date: 2024-11-12

---

Summary

The current ARFC Addendum seeks to onboard rsETH to Lido Instance. This integration aligns with the recent support for rsETH in Aave Mainnet Instance, as outlined in the ARFC proposal and the AIP that is live.

This will be a Direct to Direct AIP Proposal so we can align with the final AIP and onboarding of rsETH in Mainnet Instance.

Motivation

With rsETH set to become a reality on Aave v3 Ethereum, integrating it into the Lido Instance offers deeper liquidity, higher composability, and more strategic borrowing opportunities for users. Given the synergy between wstETH and rsETH as liquid staking derivatives (LSDs), enabling eMode will maximize capital efficiency for borrowers while maintaining a conservative risk approach.

Specification

Risk Parameters will be provided by Risk Service Providers and ARFC will be updated accordingly.

ARFC has been updated with latest feedback from RSP. 2024-11-29

Parameter	Value
Asset	rsETH
Isolation Mode	N/A
Borrowable	No
Collateral Enabled	Yes
Supply Cap	10,000
Borrow Cap	-
Debt Ceiling	-
LTV	0.05%
LT	0.10%
Liquidation Bonus	7.5%
Liquidation Protocol Fee	10%
Variable Base	-
Variable Slope1	-
Variable Slope2	-
Uoptimal	-
Reserve Factor	-
Stable Borrowing	Disabled
Flashloanable	Yes
Siloed Borrowing	No
Borrowable in Isolation	No

E-mode Specification

Parameter	Value	Value
Asset	rsETH	wstETH
Collateral	Yes	No
Borrowable	No	Yes
Max LTV	92.50%	-
Liquidation Threshold	94.50%	-
Liquidation Bonus	1.00%	-

Next Steps

1. Collect community feedback and Risk Service Providers feedback.
2. Publication of an AIP for final confirmation and synchronizing with rsETH AIP publication to have at the same time rsETH on Mainnet and Lido Instances.

Disclaimer

This proposal is made independently by the ACI.

ACI has not been ACI did not received compensation for creation of this proposal.

Copyright

Copyright and related rights waived via CC0.

[LlamaRisk]

@ACI

The current ARFC Addendum seeks to onboard rsETH to Lido Instance.

LlamaRisk supports the onboarding of rsETH as collateral on the Lido instance. rsETH is currently being onboarded on the main Aave V3 instance where it will be part of a rsETH/wstETH/ETHx liquid E-mode. The 19k rsETH supply cap is already maxed out, which indicates strong borrowing demand against rsETH.

On the Aave V3 Lido instance, we believe rsETH could be part of three existing liquid E-modes:

• ETH correlated, as collateral only to borrow WETH.
• LRT stablecoins main, as collateral only to borrow stablecoins.
• LRT wstETH main, as collateral only to borrow wstETH.

rsETH is currently backed by ETH (59.5%), ETHx from Stader (32.5%), and wstETH from Lido (8%). wstETH deposits are capped, currently sitting at 19,682/200k (approximately 10%), giving ample room for growth. When it comes to WETH, there is no limit on deposits. Including rsETH into E-modes containing ETH and wstETH offers both KelpDAO and Aave significant growth opportunities.

Since our last review, KelpDAO has implemented a bug bounty program of $250k on Immunefi. Liquidity has decreased since our previous assessment on July 24th, 2024, with 4,950 rsETH available within 7.5% of the impact price as of November 22nd, 2024. The usual supply cap methodology yields a recommended 10k supply cap and a 1k borrow cap. This liquidity should be able to accommodate liquidations from both the main instance and the Lido instance.

Previous research:

• Comprehensive collateral assesment, July 24th, 2024
• Aave V3 collateral assesment, July 25th, 2024

Disclaimer

This review was independently prepared by LlamaRisk, a community-led non-profit decentralized organization funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.

The information provided should not be construed as legal, financial, tax, or professional advice.

[TokenLogic]

While it is exceptional to see two Supply Cap increases—19k and 38k—filled so quickly, we believe the existing wstETH supply on the Core instance of Aave v3 justifies delaying the onboarding of rsETH to the Prime instance.

Discussions with teams actively using or planning to use rsETH suggest that any additional Supply Cap is likely to be filled rapidly. However, with over $4 billion of wstETH already available on the Core instance, there is significant untapped potential for users in that market.

Currently, the strategies being deployed on the Core instance provide higher economic returns compared to if those same strategies were deployed on the Prime instance. Until the wstETH borrow rate on the Core market aligns more closely with that of the Prime market, the Core instance will remain the more attractive option for users. Given the size of the Core market, we anticipate limited adoption of rsETH on the Prime market. Considering the relative advantages of the Core over Prime and the borrow rate sensitivity of wstETH strategies, we believe the Aave DAO can realise all the upside of listing rsETH on the Core market in the immediate to near term.

We would support a Direct-to-AIP proposal that substantially increases the rsETH Supply Cap and wstETH Borrow Cap on the Core market. This follows the precedent set during the onboarding of cbBTC.

[ChaosLabs]

Overview

Chaos Labs supports the listing of rsETH in the Aave V3 Lido instance with restrictive parameters. We also recommend the creation of a Liquid E-Mode configuration that enables leveraging Kelp rewards through wstETH borrowing.

Motivation

The demand for rsETH looping strategies, as evidenced in Aave’s main market, has been substantial. The initial supply cap, along with its first increase, was filled quickly, primarily driven by CIAN’s rsETH Yield Layer strategy. This strategy uses rsETH as collateral to borrow wstETH, leveraging the underlying yield of reETH.

The CIAN strategy alone has an additional 540 rsETH, representing 10% of its size, queued to be deposited. Based on the leverage used in the strategy, this could translate to 4,200 rsETH deposits into Aave.

While CIAN currently accounts for all rsETH deposits in Aave’s main market, this high demand suggests that other users may adopt similar strategies if additional capacity is provided. Moreover, the implied APY of Pendle’s rsETH PT tokens aligns closely with the implied APY of ezETH, indicating that an rsETH listing would not disrupt the market balance.

LT, LTV, and Liquidity Bonus

To maintain the Lido instance’s intended purpose and limit the number of asset pairs, we recommend setting conservative LTV and LT parameters for rsETH outside of E-Mode. Hence we recommend an LT of 0.10%, an LTV of 0.05%, and a Liquidation Bonus of 7.5%. This configuration aligns with the parameters adopted for ezETH in the same instance. Additionally, we recommend listing this asset as non-borrowable to prevent looping for point farming.

Supply and Borrow Caps

Following Chaos Labs’ approach to initial supply caps, we propose setting the Supply Cap at 2x the liquidity available under the Liquidation Bonus price impact.

Considering the reduced DEX liquidity over the past three months, we recommend an initial supply cap of 10,000 rsETH.

E-Mode

To align with the Ethereum main market, we propose creating an isolated Liquid E-Mode for rsETH and wstETH. In this configuration, rsETH would be enabled only as collateral, and wstETH only as borrowable. The parameters should mirror those of the Ethereum main instance: LT of 94.5%, LTV of 92.5%, and a Liquidation Bonus of 1%. These values reflect the similar risk profiles of the two instances.

Specification:

Chaos Labs recommends listing rsETH in the Lido instance with the following parameters:

Parameter	Value
Asset	rsETH
Isolation Mode	N/A
Borrowable	No
Collateral Enabled	Yes
Supply Cap	10,000
Borrow Cap	-
Debt Ceiling	-
LTV	0.05%
LT	0.10%
Liquidation Bonus	7.5%
Liquidation Protocol Fee	10%
Variable Base	-
Variable Slope1	-
Variable Slope2	-
Uoptimal	-
Reserve Factor	-
Stable Borrowing	Disabled
Flashloanable	Yes
Siloed Borrowing	No
Borrowable in Isolation	No

E-mode Specification

Parameter	Value	Value
Asset	rsETH	wstETH
Collateral	Yes	No
Borrowable	No	Yes
Max LTV	92.50%	-
Liquidation Threshold	94.50%	-
Liquidation Bonus	1.00%	-

Disclaimer

Chaos Labs has not been compensated by any third party for publishing this recommendation.

Copyright

Copyright and related rights waived via CC0