Summary
LlamaRisk recommends cautionary onboarding of WBTC and rsETH to the zkSync V3 instance. For WBTC, we found limited liquidity, with only 1.2 WBTC available within a 7.5% price impact. No additional risks arise from WBTC’s design on zkSync beyond those already associated with the zkSync official bridge, which Aave is currently bearing. This begs the question of the profitability of a WBTC market on the ZkSync instance.
As for rsETH, like in other L2s where rsETH is onboarded, we recommend a rsETH-wstETH E-mode but not a rsETH-stablecoin E-mode because the demand for it is expected to be minimal. We previously did a comprehensive review of rsETH on Ethereum mainnet, and our positive outlook remains unchanged. However, a significant risk arises from an EOA being able to send the ETH deposited in a contract to itself, which could result in the loss of users’ funds and liquidation risks. After discussions with the Kelp team, they confirmed they would revoke the bridging role from the EOA and implement a more secure mechanism. We will post an update when this is completed and recommend waiting until these changes are implemented before onboarding rsETH on the zkSync instance.
WBTC on zkSync
WBTC is a wrapped BTC asset currently live on the Core, Arbitrum, Optimism, and Polygon markets. It represents tokenized BTC custodied by BiTGlobal. The asset has a $13b market cap across networks. It is the oldest Bitcoin asset on mainnet and is ERC20 compatible. We recently covered the transition of the asset in November 2024.. This asset has migrated successfully and seen no stability issues since BiTGlobal took ownership.
Liquidity
This asset has a $9.6M market capitalization on this network. It has been steady since it first bridged in August 2024. The WBTC is relatively well distributed, with 20% being held in Venus. As it is at supply cap, this indicates unmet demand for the asset in lending protocols.
Source: SyncSwap WBTC to USDC swap, January 23rd, 2025
DEX liquidity in the SyncSwap WBTC/ETH, the main liquidity venue for WBTC on ZkSync, is limited with only 1.2 WBTC ($110k) available to be sold within a 7.5% price impact. However, this pool has very fragmented liquidity, which reduces the possibility of one liquidity provider removing most of the liquidity and preventing profitable liquidation.
Access Control
As a tokenized asset managed by a custodian, WBTC has a simpler architecture than other ZkSync assets, such as wstETH and weETH. This streamlined design reduces smart contract risks. WBTC on ZkSync is bridged through the ZkSync official bridge, which is still in beta and controlled by the ZkSync team. However, the limited documentation regarding this bridge introduces some risks. The bridge was audited by OpenZeppelin, with one medium-risk issue identified.
The ERC20 contract for WBTC is written in a modified zkSNARK-compatible version of Solidity, making it distinct from the Ethereum-based WBTC contract. While this introduces compiler risks that could lead to unintended behavior, the contract has been audited. Only the ZkSync official bridge is authorized to mint and burn WBTC on ZkSync.
These risks are not unique to WBTC. Other assets on Aave’s ZkSync instance, such as WETH, have been onboarded with similar inherent risks. As such, onboarding WBTC represents a minimal incremental risk to the protocol.
Price Feed
We recommend setting WBTC’s price feed to that of Chainlinks’ BTC/USD feed, as is the case with other instances.
rsETH on ZKsync
The main token for rsETH on ZkSync is wrsETH, a wrapper contract around the underlying rsETH being bridged. Since they are atomically redeemable 1-1 for each other, we refer to them interchangeably.
Liquidity
Source: Kyberswap, January 27th, 2025
There is meaningful liquidity for rsETH on ZkSync, with 356 rsETH ($1.07m) available within a 7.5% price impact. The two main liquidity pools are the SyncSwap ETH/wrsETH pool ($304k of TVL) and the KOI WETH/wrsETH pool ($1.61m of TVL).
Access Control
There are two controlling wallets:
Here are the Kelp contracts deployed on ZkSync:
- RSETHPoolV2: deployed behind a TransparentUpgradeableProxy contract.
- RSETH_OFT: LayerZero ERC20 contract for rsETH.
- RsETHTokenWrapper: deployed behind a TransparentUpgradeableProxy contract, a wrapper for rsETH that can be redeemed for it on a 1-1 basis.
The RSETHPoolV2 contract has the following roles:
- DEFAULT_ADMIN_ROLE: assigned to Multisig A, can reinitialize the contract, update roles, set the bridging fee, set the oracle, set the bridge, and pause/unpause the contract.
- BRIDGER_ROLE: assigned to an EOA A. You can withdraw fees and send funds for bridging through the bridge (bridgeAssets() method), but you can also send all ETH in the contract to itself (moveAssetsForBridging() method).
The RSETH_OFT contract is owned by Multisig A, which can upgrade the contract and update its parameters.
The RsETHTokenWrapper has the following roles:
- DEFAULT_ADMIN_ROLE: assigned to Multisig A, can remove rsETH from the list of allowed collateral.
- BRIDGER_ROLE: assigned to EOA A, can deposit assets to collateralize the wrsETH tokens minted.
- MINTER_ROLE: assigned to the RSETHPoolV2 contract, can mint new units of wrsETH.
No timelocks slowing down contract upgrades or parameter changes were found. The fact that EOA A can send all ETH in the RSETHPoolV2 to itself is a significant risk. In case of a malicious takeover of this EOA, rsETH could become undercollateralized, resulting in liquidations and loss of user funds. We contacted the Kelp team, and they informed us of their intention to revoke that role assignment for a more secure option.
Price feed
No Chainlink price feed is available for rsETH on ZkSync for now. We recommend using the internal exchange rate of rsETH together with CAPO. The internal exchange rate for rsETH on ZkSync is pushed through LayerZero, the risk of which is already borne by Aave since the minting and burning of rsETH on ZkSync also happens through LayerZero. This will also depend on BGD’s preference and technical evaluation.
Aave V3 Specific Parameters
| Parameter |
WBTC |
rsETH |
| Isolation Mode |
No |
No |
| Emode |
No |
Yes |
| Borrowable |
Yes |
No |
| Borrowable in Isolation |
No |
No |
| Collateral Enabled |
Yes |
Yes |
| Stable Borrowing |
No |
No |
| Supply Cap |
20 |
700 |
| Borrow Cap |
10 |
- |
| Debt Ceiling |
- |
- |
| LTV |
73% |
0.05% |
| LT |
78% |
0.10% |
| Liquidation Bonus |
7% |
7.5% |
| Liquidation Protocol Fee |
10% |
10% |
| Reserve Factor |
50% |
- |
| Base Variable Borrow Rate |
0% |
- |
| Variable Slope 1 |
4% |
- |
| Variable Slope 2 |
300% |
- |
| Uoptimal |
80% |
- |
| E-mode |
- |
wrsETH/wstETH |
rsETH/wstETH E-Mode on ZkSync
| Parameter |
Value |
Value |
| Asset |
wrsETH |
wstETH |
| Collateral |
Yes |
No |
| Borrowable |
No |
Yes |
| LTV |
92.5% |
- |
| LT |
94.5% |
- |
| Liquidation Penalty |
1.00% |
- |
Disclaimer
This review was independently prepared by LlamaRisk, a community-led non-profit decentralized organization funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work.
The information provided should not be construed as legal, financial, tax, or professional advice.
