Ripple CTO David Schwartz Flags Bridge Security Gaps

TLDR

• David Schwartz reviewed several DeFi bridge systems while assessing infrastructure for RLUSD.
• He said many bridge platforms include security tools that could prevent failures like the Kelp DAO exploit.
• Kelp DAO’s rsETH bridge was exploited on April 18 with losses estimated between $290 million and $292 million.
• Attackers drained about 116,500 rsETH through LayerZero-related bridge activity.
• Reports said the bridge relied on a one-of-one verifier model that created a single point of failure.

Ripple CTO Emeritus David Schwartz addressed bridge security concerns after a $290 million Kelp DAO exploit. He linked the incident to configuration choices within cross-chain systems. His remarks followed the April 18 attack that drained about 116,500 rsETH.

David Schwartz Reviews Bridge Security in RLUSD Planning

David Schwartz said he reviewed multiple DeFi bridging systems while assessing infrastructure for RLUSD. He focused on risk controls and operational safeguards. He stated that many systems included protections capable of preventing failures like the Kelp DAO exploit.

He wrote that several platforms appeared technically sound during his evaluation. However, he said providers often promoted easier deployments over strict safeguards. He explained that teams sometimes bypass stronger protections to speed expansion across chains.

Schwartz said the issue does not always stem from missing security tools. Instead, he argued that configuration decisions shape real-world risk exposure. He added that teams may prioritize cost and convenience during early rollout phases.

He said he had a “funny feeling” that Kelp DAO may not have used key LayerZero protections. He linked that possibility to practical deployment choices. He framed the concern within Ripple’s review process for RLUSD infrastructure.

Kelp DAO Exploit Drains 116,500 rsETH and Hits Aave

Kelp DAO’s rsETH bridge suffered an exploit on April 18. Attackers drained 116,500 rsETH through LayerZero-related bridge activity. Public estimates placed losses between $290 million and $292 million.

Incident reviews identified a weak verification structure within the bridge configuration. Reports said the system relied on a one-of-one verifier model. That setup created a single point of failure for message validation.

Analysts said the attacker forged a message to release assets from escrow. As a result, the bridge transferred funds without proper multi-party verification. The structure became central to post-incident technical discussions.

After the breach, attackers used stolen rsETH as collateral on Aave v3. They borrowed wETH against those deposits. Aave later froze several rsETH and wETH markets.

Reports estimated that Aave faced roughly $195 million in bad debt exposure. The protocol acted to contain further risk. Those actions followed the sharp drop in total value locked.

Developers debated responsibility for bridge security design following the exploit. Some argued that applications need flexibility in selecting verification models. Critics countered that flexible defaults can enable weaker configurations.

Schwartz said Ripple weighed these practical risks during its RLUSD evaluation. He stressed that deployment settings matter as much as theoretical design. His comments placed focus on how teams implement bridge safeguards in practice.

The post Ripple CTO David Schwartz Flags Bridge Security Gaps appeared first on CoinCentral.