# \[Direct-to-AIP\] Onboard wrsETH to Aave v3 Plasma Instance **URL:** \ **Category:** New Asset\ **Created:** [September 29, 2025, 12:09pm UTC](https://governance.aave.com/t/direct-to-aip-onboard-wrseth-to-aave-v3-plasma-instance/23183 "2025-09-29T12:09:36Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![LlamaRisk](https://dub1.discourse-cdn.com/flex013/user_avatar/governance.aave.com/llamarisk/32/12865_2.png) [@LlamaRisk](https://governance.aave.com/u/LlamaRisk)\ **Post date:** [October 3, 2025, 11:48am UTC](https://governance.aave.com/t/direct-to-aip-onboard-wrseth-to-aave-v3-plasma-instance/23183/2 "2025-10-03T11:48:39Z")
## **Summary** LlamaRisks supports the onboarding of wrsETH to the Plasma instance. wrsETH’s architecture follows the same OFT design seen in rsETH on other L2s onboarded. Onchain supply at the time of writing was approximately 736 rsETH, with liquidity for wrsETH concentrated in 2 Balancer V3 and Curve pools. While market liquidity is rapidly evolving, we note that 695 wrsETH (~$3.2M) could be swapped within a 7.5% price impact. Moreover, we identified a security concern regarding the `BRIDGER_ROLE` being assigned to an Externally Owned Account (EOA), which would enable it to bridge funds to itself. In the event this EOA were to be compromised, user funds could be at risk. Following a discussion with the KelpDAO team, they informed us that this function would be deprecated and that the `BRIDGER_ROLE` would be temporarily assigned to a 3/6 multisig until the upgrade is effected. We are currently in contact with the Kelp team to facilitate this update. Once the EOA is unassigned and the multisig is assigned the role, we will update the community, and will then be able to proceed with the onboarding process on the Plasma instance. This represents a secure interim mechanism until the full upgrade is completed. We will provide a community update as soon as this change is implemented. ## **1. Asset Fundamental Characteristics** ### **1.1 Asset** wrsETH is the wrapped version of the liquid restaking token rsETH, backed by LSTs such as ETHx, stETH, and native ETH. Extensive analyses of rsETH have been conducted in the past, with previous reports detailing its design and risk considerations, including: **[Add rsETH to Aave V3 Ethereum](https://governance.aave.com/t/arfc-add-rseth-to-aave-v3-ethereum/17696/8)**, **[Onboard wrsETH to ZKsync V3 Instance](https://governance.aave.com/t/arfc-onboard-wrseth-to-zksync-v3-instance/20727/2)**, and **[rsETH Collateral Risk Assessment](https://www.llamarisk.com/research/collateral-risk-rseth)**. ### **1.2 Architecture** **[rsETH](https://plasmascan.to/token/0x9eCaf80c1303CCA8791aFBc0AD405c8a35e8d9f1?type=erc20&chainid=9745)** is bridged through LayerZero infrastructure and utilizes the Omnichain Fungible Token (**[OFT](https://docs.layerzero.network/v2/developers/evm/oft/quickstart)**) standard. Since OFTs are already present on Aave markets, the bridging mechanism poses little additional architectural risk. ### **1.3 Tokenomics** **[wrsETH](https://plasmascan.to/token/0xe561FE05C39075312Aa9Bc6af79DdaE981461359?type=erc20&chainid=9745)** can be swapped 1:1 with rsETH, as with other deployments. A total of ~736 wrsETH (~$3.3M) is currently available on Plasma, with 7 accounts registered as holders. Effectively, 3 addresses hold 100% of the supply, namely a **[BalancerV3 vault](https://plasmascan.to/address/0xbA1333333333a1BA1108E8412f11850A5C319bA9/contract/9745/code)** (~57%), Curve **[wrsETH/WETH](https://plasmascan.to/address/0x5D37F9B272ca7cdA2A05245b9a503746EefAC88f)** pool (~32%), and an **[EOA](https://plasmascan.to/address/0xd8495B95a3A6a85F4e3baA003E8b7ed1eD85562d/tokentxns?tokenaddresses=0xe561FE05C39075312Aa9Bc6af79DdaE981461359)** (~11%). The other 4 addresses registered hold marginal amounts of wrsETH. This low supply is reflective of the recent Plasma mainnet Beta launch. ## **2. Market Risk** ### **2.1 Liquidity** Approximately 695 wrsETH worth ~$3.2M can be swapped within a 7.5% price impact. ![image](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/0/0974247e622d33f61303d58da2691bee1192fcb1.png) _Source: Kyberswap, October 1st, 2025_ The two main liquidity venues are the Balancer **[wrsETH-waPlaWETH](https://balancer.fi/pools/plasma/v3/0x05eb2d848c431b1a37d0cf0eecc7f211b3bb1dee)** pool (~$3.8M TVL) and the Curve **[wrsETH/WETH](https://plasmascan.to/address/0x5D37F9B272ca7cdA2A05245b9a503746EefAC88f/tokentxns?tokenaddresses=0xe561FE05C39075312Aa9Bc6af79DdaE981461359)** pool (~$2.1M TVL). ![image](https://europe1.discourse-cdn.com/flex013/uploads/aave/original/2X/8/874211a600bb854a3f7159172eaec68005269f5f.png) _Source: Trade Routes, Kyberswap, October 1st, 2025_ ### **2.2 Volatility** Price history for wrsETH on Plasma is limited, given the network’s recent launch (September 25th). ### **2.3 Growth** The assets’ growth on the chain is too early to determine, given its recent deployment. ## **3. Technological Risk** ### **3.1 Smart Contract Risk** Since our collateral risk analysis of rsETH, in addition to the 3 audits we noted from SigmaPrime, Code4rena, and MixBytes, 2 additional **[audits](https://kelp.gitbook.io/kelp/audits)** have been completed by Sigma Prime: - June 2024 - 1: 1 high issue, 2 medium issues, 2 low issues, and 4 informational issues were found. The highest rated risk concerned incorrect accounting for stakedButUnverifiedNativeETH. Issues were either resolved or acknowledged (low and informational issues). - June 2024 - 2: 2 critical issues, 3 medium issues, 6 low issues, and 12 informational issues were found. Issues were either resolved or acknowledged (closed). ### **3.2 Bug Bounty Program** Layerzero and Kelp DAO both have bug bounties, with max bounties worth **[$15.5M](https://immunefi.com/bug-bounty/layerzero/scope/#top)** and **[$250K](https://immunefi.com/bug-bounty/kelp-dao/scope/#top)**, respectively. ### **3.3 Price Feed Risk** A Chainlink **[wrsETH/ETH](https://plasmascan.to/address/0xee3d5f65B03fabA5B2bF2eCE893399EA88b18e78/contract/9745/code)** exchange rate price feed is available. The custom feed has a deviation threshold of 0.05% and a 24-hour heartbeat. Additionally, a LayerZero cross-chain rate **[receiver](https://plasmascan.to/address/0xF1fD29270e61D4a7885E9B4EF6476Daf2Ab6F85D/contract/9745/code)** (RSETHRateReceiver) is available, which receives and stores the rsETH/ETH exchange rate updates from the RSETHMultiChainRateProvider **[contract](https://etherscan.io/address/0x0788906B19bA8f8d0e8a7015f0714DF3179D9aB6#code)**. The cross-chain risk associated with this is the utilization of LayerZero infrastructure to pass price updates effectively. ## **4. Counterparty Risk** ### **4.1 Access Control Risk** #### **4.1.1 Contract Modification Options** Deployed Kelp DAO contracts on Plasma: **[RSETHPoolV3](https://plasmascan.to/token/0xd59d17b0503b45F365670bDe9D002B9886EBC02b/contract/proxyImplementation)**: the deposit pool for rsETH, deployed behind a TransparentUpgradeableProxy contract. **[RSETH\_OFT](https://plasmascan.to/token/0x9eCaf80c1303CCA8791aFBc0AD405c8a35e8d9f1?type=erc20&chainid=9745)**: LayerZero ERC20 contract for rsETH. **[rsETHWrapper](https://plasmascan.to/token/0xe561FE05C39075312Aa9Bc6af79DdaE981461359?type=erc20&chainid=9745)**: is deployed behind a TransparentUpgradeableProxy contract. **[RSETHRateReceiver](https://plasmascan.to/address/0xF1fD29270e61D4a7885E9B4EF6476Daf2Ab6F85D/contract/9745/code)**: contract acts as rsETH’s oracle on Plasma RSETHPoolV3 has the following roles: - DEFAULT\_ADMIN\_ROLE: can assign roles, unpause the contract, and change parameters, e.g., minting limit, fees. Assigned to **[Multisig A](https://plasmascan.to/address/0x5Ae348Bb75bC9587290a28636187B840E1F5dca2/contract/9745/code)** - BRIDGER\_ROLE: able to withdraw collected fees and move assets for bridging. Assigned to **[EOA A](https://plasmascan.to/address/0x7AAd74b7f0d60D5867B59dbD377a71783425af47)** - OPERATOR\_ROLE: can perform rsETH to supported asset swaps. Assigned to **[EOA A](https://plasmascan.to/address/0x7AAd74b7f0d60D5867B59dbD377a71783425af47)** - PAUSER\_ROLE: Pause contract operations. Assigned to **[Multisig B](https://plasmascan.to/address/0x789565f3Ee6a98cE003f7aF900dc50476aa7e49A/contract/9745/code)** - TIMELOCK\_ROLE: can enable and disable deposits, change the oracle, and change supported assets. Assigned to **[TimelockController](https://plasmascan.to/address/0x5aFDa76893CB7f9dE170B59D34f5E95dB5aDC4E0/contract/9745/code).** RSETH\_OFT is owned by **[Multisig A](https://plasmascan.to/address/0x5Ae348Bb75bC9587290a28636187B840E1F5dca2/contract/9745/code)**. The owner has access to functions related to LayerZero’s OFT (e.g., cross-chain functionality, fees, and pause abilities) and OpenZeppelin’s Ownable (e.g., transfer ownership and renounce ownership) privileges. rsETHWrapper has the following roles: - DEFAULT\_ADMIN\_ROLE: can assign roles and unpause the contract. Assigned to **[Multisig A](https://plasmascan.to/address/0x5Ae348Bb75bC9587290a28636187B840E1F5dca2/contract/9745/code)**. - BRIDGER\_ROLE: can deposit assets to collateralize wrsETH. Assigned to **[EOA A](https://plasmascan.to/address/0x7AAd74b7f0d60D5867B59dbD377a71783425af47)**. - MINTER\_ROLE: allows the role holder to mint new wrsETH. Not currently assigned (users can mint wrsETH via asset deposits). - TIMELOCK\_ROLE: can change supported assets. Not currently assigned - MANAGER\_ROLE: is defined but does not have assigned functions or accounts. RSETHRateReceiver is owned by the TimelockController. The BRIDGER\_ROLE grants **[EOA](https://plasmascan.to/address/0x7AAd74b7f0d60D5867B59dbD377a71783425af47)** direct access to funds that can be bridged to the account itself through the moveAssetsForBridging function; no timelocks or limits are imposed (beyond fees). In the event this EOA becomes compromised, funds could be siphoned out, leaving rsETH undercollateralized. We contacted the Kelp team about this concern and proposed deprecating the function as was previously done for the wrsETH onboarding to the ZKSync instance. #### **4.1.2 Timelock Duration and Function** No time locks are implemented directly; however, the TimelockController contract acts as a timelocked admin able to propose operations and execute them after a delay. As noted in section 4.1.1, the TimelockController is assigned the TIMELOCK\_ROLE in the deposit pool contract; therefore, changes made by the TimelockController apply a delay to only this role’s functions. Currently, the minimum delay is set to 3 days. Within the deposit pool contract, the pause function is exposed and accessible by the PAUSER\_ROLE #### **4.1.3 Multisig Threshold / Signer identity** **[Multisig A](https://plasmascan.to/address/0x5Ae348Bb75bC9587290a28636187B840E1F5dca2/contract/9745/code)** has a 3/ 6 threshold. **[Multisig B](https://plasmascan.to/address/0x789565f3Ee6a98cE003f7aF900dc50476aa7e49A/contract/9745/code)** has a 1/5 threshold. Signers are comprised of Kelp core team solely. Note: This assessment follows the LLR-Aave Framework, a comprehensive methodology for asset onboarding and parameterization in Aave V3. This framework is continuously updated and[](https://github.com/llama-risk/aave-research/blob/main/frameworks/aave_v3_framework.md)**[available here](https://github.com/llama-risk/aave-research/blob/main/frameworks/aave_v3_framework.md)**. [/details] ## **Aave V3 Specific Parameters** Owing to the Plasma’s recent deployment, liquidity is evolving rapidly, and new liquidity pools are being bootstrapped. We have reviewed ACI’s proposed parameters and will provide revised recommendations and will provide them jointly with @ChaosLabs, which will post them here shortly. ## **Price Feed Recommendation** We recommend using the internal exchange rate of rsETH together with CAPO, in conjunction with Chainlink ETH/USD price feed, as has been utilized for other rsETH markets. ### **Disclaimer** This review was independently prepared by LlamaRisk, a DeFi risk service provider funded in part by the Aave DAO. LlamaRisk is not directly affiliated with the protocol(s) reviewed in this assessment and did not receive any compensation from the protocol(s) or their affiliated entities for this work. The information provided should not be construed as legal, financial, tax, or professional advice. --- _[View the full topic](https://governance.aave.com/t/direct-to-aip-onboard-wrseth-to-aave-v3-plasma-instance/23183)._