Aave proposes risk framework after $290M KelpDAO hack

Aave on Tuesday published a proposed risk framework prepared by LlamaRisk and opened it for review by the protocol’s governance community. The plan centers on four areas-asset risk, bridging risk, chain risk and advanced automation-and would apply to Aave V3, V4 and the upcoming Aave Horizon markets.

The proposal sets new rules for onboarding assets, requires quarterly due-diligence refreshes and mandates re-evaluations after material changes to listed tokens. It also ties risk criteria to specific governance actions for parameter changes and deprecations. LlamaRisk wrote that the document is intended to become the standard against which every listing and every parameter decision is measured once the framework is endorsed.

Assets that fail to meet the new standard will be removed from the protocol over the coming weeks, the proposal says.

Aave framed the proposal as a response to an April exploit of the LayerZero-powered KelpDAO rsETH bridge. Attackers withdrew about 116,500 rsETH, roughly $292 million at the time, and deposited a portion of those tokens into Aave V3. The exploiter used rsETH as collateral to borrow large amounts of wrapped Ether (WETH), increasing the protocol’s exposure to potential bad debt.

Under the draft framework, asset reviews would be more stringent and bridge-related requirements tightened to reduce similar contagion paths. Automated monitoring tools are proposed to detect unusual activity faster and enable quicker responses. The proposal says these measures will make it simpler to offboard problematic assets before issues spread across markets.

Stani Kulechov, Aave’s founder, wrote on social media that the protocol has been developing the framework for several weeks and that it “establishes a new standard for how Aave assesses, monitors, and manages risk across the protocol.” LlamaRisk wrote: “This framework sets the risk standard that governs every asset on Aave V3, V4, and Aave Horizon. It is binding at onboarding, at every quarterly due diligence refresh, at every material-change re-evaluation, and at every parameter or deprecation decision taken on a listed asset.”

The proposal will move through Aave’s governance process, where delegates and token holders can evaluate and vote on adoption. If approved, the protocol will roll out the framework across its markets and begin offboarding assets that do not meet the established criteria.