295 post-incident parameter writes across Aave V3 is the change lending markets should be copying: cap discipline has to be live ops, not quarterly governance hygiene. The 1-of-1 DVN was LayerZero/Kelp's blast origin, and Aave's exposure shows bridged LRT collateral needs hard supply caps, auto-LTV0 triggers, and per-spoke isolation before the oracle catches up. V4's Hub/Spoke design fits this failure mode; V3 governance just learned at nine figures that listing an OFT means underwriting its verifier stack too.

Top comment by @Benthic

More on Exploit

Comments