The Unseen Risks of Restaking w/ Tarun Chitra

Tarun Chitra traces DeFi's structural vulnerability to a foundational property: composing individually safe payoff functions can produce unintended combined outcomes. That risk has grown more dangerous as the ecosystem has expanded.

Compound introduced the first pooled all-to-all lending model, and Aave v2 followed the same structure until the Three Arrows Capital collapse in May 2022. That event involved a looped staked ETH position that caused unnecessary liquidations harming ETH depositors while stablecoin depositors profited, pushing the industry toward isolated lending pods. Aave v3 introduced asset-pair-specific parameters, but adding new assets still required slow governance votes, which created the opening for curator-managed vaults that can update parameters every block. Curators can only adjust loan-to-value ratios, collateral selection, interest rate curves, and oracle choice, and are contractually prevented from touching user assets. The key advantage over DAO models is that static DAO parameters must be set conservatively for an entire week to cover tail risk, meaning borrowers receive worse terms during roughly 80 percent of conditions that would support more favorable ratios.

DAO governance produced persistent incentive failures: token holders voted to add collateral they personally owned, VCs used governance votes to create partnerships for portfolio companies, and removing collateral was treated as a greater political risk than adding it. Gauntlet was the first to publicly recommend removing Curve from Aave before a November 2022 incident involving Avi Eisenberg, but token holders resisted because of emotional attachment to Curve from DeFi summer gains and because Michael Egorov's borrowing had historically generated significant protocol fees. Chitra cites this as an earlier moment that undermined the narrative that DeFi never requires bailouts, given that Egorov minted the governance token himself, borrowed heavily against it, and a bailout mechanism existed for him.

The Resolve stablecoin exploit involved a compromised AWS private key controlling the mint function, allowing an attacker to mint USR tokens and borrow against them in Morpho vaults before exiting. Chitra notes the attack was not specific to the vault model and would have occurred in a fully pooled protocol like Aave if USR had been listed there. MEV solvers running during the attack inadvertently accelerated it by back-running oracle updates, with some participants unaware their bots were aiding the attacker. The Kelp exploit involved a nonce check in the Layer Zero messaging protocol being enforced on one side of a bridge but completely skipped on the other, enabling a replay attack that altered the token supply. Kelp was using a one-of-one DVN configuration, meaning a single node controlled message validation, and that node was operated by Layer Zero itself. Chitra raises two hypotheses: a zero day in the RPC node software or a compromise of Layer Zero's own infrastructure, with the latter considered more dangerous. He also raises a supply chain attack hypothesis in which a vulnerable library embedded in a default Layer Zero Docker image could have infected all L2 deployments using that image, including Unichain and Arbitrum, and warns additional compromised systems may not yet be identified.

Chitra describes the RSE restaking situation as functioning like a Ponzi, with some loan-to-value ratios as high as 0.98 to 0.97, implying leverage of 30 to 40 times. He frames contagion from restaking-related hacks as a direct challenge to composability, which he identifies as one of DeFi's primary selling points over traditional finance. He also notes that the number of oracle failures that have led to DAO paybacks is quite high, framing this as a form of bailout that blurs the line between insurance and bailout in composable systems.

Chitra argues that formal verification requires manually defined invariants that break down in dynamic systems, and that AI agents can now generate and update invariants in real time by analyzing recent blockchain usage. He uses the Drift hack as a concrete example where an attacker spent months gradually changing multi-sig signers, a change existing monitoring systems missed because the number of signers was not built in as a monitored invariant. He predicts the next two years will be difficult for DeFi because AI-powered attackers will have the upper hand initially, drawing an analogy to the 2010 to 2015 period when companies moved to the cloud without anticipating SQL injection attacks, causing cybersecurity insurers to suffer heavy losses before best practices emerged.

Chitra contends that greater composability increases vulnerability to complex attack vectors, while less composability reduces attacks but also reduces capital efficiency. He expects DeFi composability to become bounded, with some interactions subject to timelocks or sandboxing, and mentions capping withdrawals at 100 million dollars per three blocks as a practical near-term mitigation. He argues the crypto industry has set a precedent that systems should allow asset seizure, citing the recovery of funds taken by North Korea, and states this fundamentally contradicts code-is-law principles. He identifies HyperLiquid as the project that most correctly timed the market's pivot away from caring about decentralization, and identifies the Arbitrum bridge for HyperLiquid as what he considers the largest current honeypot attack surface given the concentration of funds.