Weekly Deep Dive: How a Reordered Withdrawal Took $7.8m of rsETH

1 1. In brief

On 15 September 2026, about 2,900 rsETH — roughly $7.8m — left Kelp DAO's staking system without a single signature being forged or a single key being stolen. An MEV searcher nicknamed 'Yoink' paid about 19 ETH in priority fees to have a legitimate withdrawal reordered ahead of a pause, at block 25,980,525, capturing 2,882.37 rsETH before the circuit breaker could engage.

The pattern ran as one coordinated sequence in the early hours of Monday. The withdrawal was real and the validator signature was valid; the attacker simply paid to win the slot and land ahead of the pause. Kelp had enabled a Safe module whose executor / Multicall contract accepted target = address(this) as a valid authorisation, and that was the gap.

2 2. Background: what rsETH is, and why the Safe module

Kelp DAO runs one of the larger liquid restaking protocols: users deposit ETH or liquid staking tokens and receive rsETH, a transferable receipt that accrues restaking yield. rsETH is one of the receipts in the liquid-staking tables we track. The security model rests on withdrawals being processed only through authorised modules, and on a pause switch that can freeze withdrawals if something looks wrong.

The Safe module — a Gnosis Safe-style executor that lets the protocol batch and automate operations — was switched on to make withdrawals and other administrative actions more efficient. It is a convenience layer, not part of the core staking math. The integration lived in Kelp's operational tooling, and the flaw sat in how that module checked whether an instruction was allowed to act on the vault.

One structural point matters for everything that follows. The vulnerability was not in Safe itself — Gnosis Safe's core contract behaved exactly as specified. It was in a module the protocol had attached to its own setup and had the authority to enable and configure. The trust boundary moved from 'is this a valid Safe transaction' to 'is this module allowed to instruct the vault', and nobody re-examined what the second question now required.

3 3. Mechanism: a valid withdrawal, reordered

Reconstructing the sequence from Kelp's statements and the on-chain trace gives a path with four steps and no exotic cryptography at any of them.

The step that fails safely on most designs is step 4. A pause is supposed to be the circuit breaker — once it lands, no further withdrawals process. But block ordering is by priority fee, not by intent, so a transaction that pays more lands first. The bot paid ~19 ETH to ensure its already-signed withdrawal executed before the pause took effect, and captured 2,882.37 rsETH in that gap.

The attacker behaved like someone exploiting a known race rather than discovering one. A single coordinated sequence, a real withdrawal, a genuine signature, and a fee paid to win the slot — there was no probing ladder this time, just one well-timed move. That is the mark of an actor who understood the ordering rule and priced the slot.

4 4. Root cause: an authorisation check that trusted its own input

A withdrawal system needs to bind every instruction it acts on to something it can verify. On a normal path, the keeper signs the withdrawal and the vault pays it — the signature is the binding. The Safe module added a second instruction channel: the executor could call the vault on the protocol's behalf, and its authorisation check accepted target = address(this) — it treated the module calling itself as sufficient proof that the call was allowed.

In plain terms, the module could instruct the vault to pay out using an authorisation that resolved to 'the module authorised itself'. The keeper signature proved a withdrawal existed; it did not prove the module's self-call was the one the withdrawal was meant to take. Treating the second as covered by the first is the defect in one sentence.

The failure is therefore not in Safe, not in rsETH's staking math, and not in the keeper's keys. Every component behaved as specified. The specification itself contained the gap: a module with a self-authorising executor, attached to a vault that trusted it, in a block where ordering is for sale.

5 5. Detection, response and the recovery plan

The breach was discovered the way most drains are: the funds moved and someone noticed. Kelp paused the contract at 0xc70f…80ea0 for 24 hours once the outflow was clear, and published a statement acknowledging the Safe-module vector rather than a core compromise. Blockaid estimated the loss at $7.73m and BlockSec at $7.81m — both close to the ~$7.8m figure Kelp's own accounting implied.

Three commitments matter for assessing the outcome. First, the affected module was disabled, so the vector is closed at the source rather than merely paused downstream. Second, Kelp stated it would make affected users whole, though the funding mechanism had not been named at the time of writing. Third, the bulk of the loss — 2,882.37 rsETH — was taken in a single reorder, which is unusual: most of the value was gone in one slot, not drip-fed across rounds.

Context is worth recording honestly. This is the second rsETH incident of 2026; the first, in April, traced to a LayerZero-related dependency. Two incidents in five months on the same receipt token, through two unrelated mechanisms, is the strongest available argument for treating rsETH's operational tooling — not just its staking contract — as the surface to audit.

6 6. Data: the numbers, and what each one measures

This incident produced a small set of quantities, and conflating them is how coverage of it goes wrong. Each row below is a different measurement.

The derived number worth stating plainly is the ratio between the attacker's cost and the take. About 19 ETH in priority fees — roughly $50-60k at prevailing prices — bought roughly $7.8m. That is a returns multiple most exploits never see, and it existed because the gap was a logic flaw reachable by ordinary transaction ordering, not a cryptographic break requiring skill to find.

7 7. The same window, three different mechanisms

rsETH was one of three failures in the same seven days, and the three make a controlled comparison almost nobody would design on purpose.

The finding is the same shape as recent weeks, stated one level up. Liquid created value upstream; Symbiosis minted it; Chainflip paid twice; Nostra borrowed against a phantom price; rsETH let a valid instruction be reordered. In every case the realised loss equals the exit liquidity the attacker could reach before someone pulled a switch — and rsETH's switch was a pause that simply landed one slot too late.

8 8. Impact assessment: who is actually exposed

That last row is the one to generalise. The industry now has a small catalogue of 'valid instruction, wrong timing or wrong channel' bugs, and the fix is unglamorous: bind every payout to the specific withdrawal it settles, forbid self-authorising executors on value-bearing vaults, and treat a pause as a hard pre-check rather than a transaction that can be outbid. None of it is novel cryptography. All of it is the kind of work that gets skipped when a module seems trusted because it is part of a well-known wallet.

9 9. What this changes for due diligence

• For any protocol using a Safe or similar executor module: ask whether the module can call the vault on itself, and whether that self-call is treated as authorisation.
• For withdrawal systems specifically: ask whether a pause is a hard pre-check or just another transaction that can be outbid by priority fees.
• For MEV exposure: ask what a well-funded searcher could reorder in your withdrawal path, because block ordering is for sale.
• For rsETH holders: treat the issuer's operational tooling as part of the risk, not just the staking contract — two 2026 incidents through two mechanisms argue for it.

10 10. What would change our read

This assessment rests on Kelp's own accounting and on-chain traces, published before an independent post-mortem. It would change materially if a forensic report attributes the loss to a different mechanism than a self-authorising Safe module, if the ~2,900 rsETH / $7.8m figure is revised, or if the compensation terms leave any affected user short. The disabled module and the stated make-whole promise are the specific things to read when they arrive.

The broader conclusion does not depend on those details. Six failures over the past three weeks — Liquid, Nomic, Symbiosis, Chainflip, Nostra and now rsETH — share one assumption: that the step before the payout had been checked. Until self-authorising modules, oracle dependencies and refund paths are standard audit items rather than post-incident upgrades, that is the distribution to expect: frequent small failures, and occasional $7m ones that cost 19 ETH to run.

11 11. In brief

Kelp's rsETH lost about 2,900 tokens (~$7.8m) because a Safe module with a self-authorising executor let a valid withdrawal be reordered ahead of a pause — not because a key was stolen or a signature forged. An MEV bot paid ~19 ETH to win the slot at block 25,980,525 and captured 2,882.37 rsETH before the circuit breaker landed.

For the wider system, the lesson is the same one Liquid, Chainflip and Nostra taught in the same fortnight, stated one level up: the unguarded step is wherever the last person assumed the previous step had checked it. The fix is boring, known, and not yet standard. That combination is what these weeks keep purchasing.