Aave Introduces Four-Layer Risk Framework After $292M KelpDAO Exploit

According to Aave's governance proposal, Aave introduced a new four-layer risk framework designed to govern asset listings across Aave V3, V4, and Aave Horizon. The framework—structured around asset risk, bridging risk, monitoring and automated risk oracle systems, and chain risk—sets stricter standards for asset onboarding, ongoing reviews, bridge exposure, and chain deployments.

The proposal follows April's KelpDAO exploit, in which attackers minted roughly $292 million in unbacked rsETH through LayerZero bridge, exposing weaknesses in bridge configuration and offchain infrastructure. Under the new framework, assets must meet requirements for audits, bug bounty coverage, liquidity, and timelocks. Bridge routes require at least three independent verifiers, timelocked authority changes, and per-route rate limits. Aave can automatically freeze assets when warning signs appear, while human review remains required to restore limits.