Crypto lending recovers as risks spread across connected systems

Crypto lending’s total value locked rose more than 55% since the start of July to about $56 billion, recovering after $11.33 billion left the sector in the second quarter. The rebound has renewed scrutiny of risks involving bridges, oracles, custodians and other systems linked to lending protocols.

The market contracted 16.78% in the second quarter, partly after an April exploit involving a cross-chain route used by Kelp DAO. The attack created about 116,500 unbacked rsETH tokens worth roughly $290 million at the time. Some of the tokens were deposited as collateral in Aave markets and used to borrow other assets.

Aave’s smart contracts were not breached, but deposits on the protocol fell by about $15 billion in the days after the exploit. Aave later froze its rsETH and wrsETH markets.

“When a protocol accepts a token as collateral, it is also accepting that token’s bridge, its verifier configuration, its oracle and its issuer’s operational security,” Stani Kulechov, founder and chief executive of Aave Labs, told Cointelegraph Magazine.

Kulechov said Aave has expanded its security reviews beyond its smart contracts to include the infrastructure supporting each asset. The protocol reviews every asset quarterly and conducts another review after a material change. Aave has started winding down operations on six networks that did not meet its chain-level standards.

“Every wrapper, bridge and oracle between the lender and the underlying asset is another place a loan can go wrong,” Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, told Cointelegraph Magazine.

Spark, a decentralized finance lending protocol, began phasing out rsETH from SparkLend in January, before the Kelp DAO exploit. The asset’s low usage and revenue did not justify the added risk of supporting it, according to Spark chief executive Sam MacPherson.

MacPherson described reviews covering governance, operational security, collateral quality, liquidity management and links to other systems. He added that protocols need procedures for limiting losses after an incident.

Human actions remain another source of risk. Major losses have involved key management, access controls or social engineering, according to Shawn Owen, founder and chief executive of SALT Lending. Smart contract audits may not identify those problems.

Lenders also face risks when they deploy customer assets elsewhere to generate returns. Celsius, Voyager and BlockFi failed during the 2022 market downturn after taking on risks that some customers did not understand or expect.

Ledn keeps customer Bitcoin with qualified custodians instead of lending it out for additional yield. Fewer transactions and segregated custody can reduce the number of points at which a breach may occur, Wu said.

Sid Powell, co-founder and chief executive of crypto credit platform Maple, urged lenders to track what they hold, where it is held, whether they can monitor it in real time and how quickly they can recover it after a system failure. He warned that a rapid rise in deposits can pressure managers to loosen collateral requirements or lend to weaker borrowers to maintain returns.

Aave uses artificial intelligence in security testing. Mutation testing inserted bugs into its V4 contracts, and test suites detected 271 of 304 simulated vulnerabilities. In a review of its V3 and V4 codebases, three AI security tools produced 71 findings. Human reviewers judged 20 of them valid.

“AI is very good at breadth and speed,” Kulechov said. “But around 70% of the raw findings were false positives, so expert judgment stays essential.”

Kulechov added that AI systems managing capital on blockchain networks could create new risks. Their permissions, data inputs and decision-making rules would need protection alongside the smart contracts they operate.