← All Reports
New report

KernelDAO (Kelp Gain)

3.8
hgETH (High Growth ETH)/Ethereum/September 9, 2026
View full report on GitHub →View dependency graph

Score Breakdown

Overview

hgETH (High Growth ETH) is a liquid, reward-bearing ERC-4626 vault token issued by the High Growth Vault, a product of Kelp Gain (part of the KernelDAO ecosystem). The vault is built on Upshift Finance infrastructure and curated by UltraYield (a spin-off of Edge Capital).

Users deposit ETH, LSTs (stETH, ETHx), or rsETH into the vault. All deposits are converted to rsETH (Kelp's liquid restaked ETH token) via an adapter contract, then allocated across 12+ DeFi protocols by professional fund managers. hgETH appreciates in value as yield accrues from these strategies.

Yield strategies include:

  • Leverage farming on Aave
  • Deposits on Usual, Pendle, and Elixir
  • Lending on Morpho, Euler, and Compound
  • Dynamic allocation across best-performing DeFi protocols

Multi-layered risk architecture:

  • Layer 1: ETH → rsETH (Kelp restaking via EigenLayer)
  • Layer 2: rsETH → Gain vault (active strategy deployment across 12+ protocols)
  • Layer 3: Gain vault → hgETH (ERC-4626 receipt token)

Each layer introduces additional smart contract risk, oracle risk, and counterparty risk.

Key metrics (onchain verified, September 9, 2026):

  • hgETH total supply: 5,342.88 hgETH (totalSupply() onchain) — down 53% from 11,343.37 in June 2026, down 66% from 14,752.14 in April 2026
  • hgETH total assets: 5,332.92 rsETH (totalAssets() onchain) — down 53% from 11,275.93 in June 2026
  • hgETH exchange rate: 1 hgETH = 0.9981 rsETH (convertToAssets(1e18) = 998,134,410,229,185,536) — slight recovery from 0.9941 in June but still ~3.8% below pre-exploit 1.0368 (April 2026)
  • Vault buffer (rsETH held directly by hgETH): 152.74 rsETH (~2.86% of total assets) — improved from 0.745 rsETH in June, but largely due to the 53% reduction in total assets rather than increased liquidity
  • Active loans/strategy positions: not independently verified (was 172 in June, 169 in April)
  • Vault deposits and withdrawals UNPAUSED — depositsPaused() = false, withdrawalsPaused() = false (verified onchain)
  • Underlying asset: rsETH (0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7)
  • hgETH vault TVL: ~$14.5M (KernelDAO website, September 2026)
  • Kelp protocol TVL: ~$1.1B (DeFiLlama, September 2026), recovered slightly from ~$870M in June but still down from ~$1.54B in April
  • Gain protocol TVL: ~$31.7M (DeFiLlama, September 2026), near all-time low
  • Estimated APR: 3.56% (1-month realised, per KernelDAO website) — down from 8.5–14% claimed previously
  • Redemption period: 15–18 days (per KernelDAO website, September 2026) — extended from 3–4 days reported in earlier assessments

Yearn use case per issue #65:

  • Accept hgETH as collateral, or use in a strategy
  • Morpho market: hgETH/WETH at 91.5% LLTV

Links:

Risk Summary

Key Strengths

  • Experienced team: Founders built Stader Labs ($680M+ TVL, operating since 2021). Strong institutional credibility
  • Significant funding: $19M+ raised from reputable investors (Binance Labs, SCB Limited, Laser Digital, Hypersphere Ventures)
  • Quick incident response (April 2026): Kelp's operations multisig paused rsETH contracts and bridge routes within ~46 minutes of the LayerZero exploit. hgETH vault was paused the same day. Arbitrum Security Council froze ~30,766 ETH of attacker funds within days
  • Multiple audit layers: Extensive auditing across the stack — Sigma Prime, Code4rena, MixBytes across rsETH; ChainSecurity, Hacken, Sigma Prime, Zellic across Upshift and Kernel. Only 1 public audit for hgETH/Gain vault (Sigma Prime, Nov 2024)
  • hgETH/Gain contracts not directly compromised: The April 18, 2026 exploit was on the LayerZero OFT bridge layer (escrow on Ethereum, forged DVN attestation). The hgETH vault contract, the Gain accounting, and the rsETH balances held by the vault on Ethereum were not the source of the bug
  • Non-custodial vault architecture: Upshift's design prevents curators from withdrawing funds to external EOAs; policy-constrained execution via August subaccounts
  • Nexus Mutual embedded cover: Integrated insurance covering $30M+ of vault positions against smart contract exploits, oracle failures, and liquidation mechanism failures. Does not cover strategy losses from looping/leverage liquidations, market movements, or — based on the public cover terms — bridge / cross-chain messaging failures of the kind seen in April 2026 (this would need to be confirmed with Nexus on the actual hgETH cover policy)
  • Chainlink PoR: rsETH integrated Chainlink Proof of Reserve Secure Mint (added after the April 2025 fee-minting bug)
  • rsETH governance: 6-of-8 multisig with 10-day timelock for the underlying rsETH layer

Key Risks

  • Exchange rate decreased (realized loss): The hgETH exchange rate has decreased from 1.0368 rsETH/hgETH (April 27) to 0.9941 rsETH/hgETH (June 29) — a ~4.1% loss in share value. An ERC-4626 vault should not decrease in share value unless a loss event occurred or was socialized. The cause is not publicly documented
  • Near-zero vault buffer: Only 0.745 rsETH (~0.007% of assets) is held as buffer, down from 117.13 rsETH in April. Any withdrawal >0.745 rsETH requires recalling funds from deployed strategies (3-4 day processing). Even a single medium-size redemption cannot be serviced instantly
  • Underlying rsETH peg still uncertain: ~116,500 rsETH (~18% of supply) was released from the LayerZero OFT escrow on April 18, 2026. Wrapped rsETH on bridged chains remains structurally under-collateralized. Kelp TVL has continued to decline (from $1.54B to $870M), suggesting ongoing stress. The rsETH LRT oracle price (1.0748 ETH/rsETH) has not been adjusted to reflect the loss; recovery/DeFi United AIP status is unclear
  • hgETH/USD oracle feed degraded: The latestAnswer() function on the hgETH/USD EOMultiFeedAdapter now reverts. latestRoundData() returns data but with anomalous zero-filled fields (roundId=0, startedAt=0). The feed appears partially deprecated or broken
  • Multi-layered complexity produced a real failure: The April 2026 LayerZero bridge exploit materialized the "tail event in a layered dependency chain" warned about in prior assessments
  • Actively managed vault: Unlike passive vaults, the curator (UltraYield) makes allocation decisions. The exchange-rate decrease and fee-elimination suggest some form of restructuring occurred during the pause period — details are not public
  • hgETH governance weaker than rsETH: 3-of-5 multisig with mostly anonymous signers and no verified onchain timelock, while rsETH has a 6-of-8 multisig with 10-day timelock
  • Withdrawal delay + zero DEX liquidity: 3-4 days to exit hgETH to rsETH, and negligible DEX liquidity for hgETH. The Morpho market is now essentially empty, so it is not a viable exit path either
  • Confirmed no onchain timelock: Despite Upshift documentation claiming "24-hour timelocks," no timelock exists on the hgETH ProxyAdmin upgrade path (onchain verified)
  • Bug bounty scope still excludes hgETH/Gain (unchanged): Immunefi Kelp DAO bounty covers rsETH core contracts only; the hgETH and Gain vault contracts remain out of scope

Critical Risks

  • Realized share-value loss of unknown cause (~$763K): The hgETH exchange rate decreased ~4.1% between April and June 2026 — from 1.0368 to 0.9941 rsETH/hgETH (onchain verified). Applied to the remaining 11,343 hgETH supply at ~$1,576/ETH, this represents a ~$763K loss to remaining holders. An ERC-4626 vault should never decrease in share value — shares should only appreciate as yield accrues. The cause (strategy losses, restructuring write-down, fee charge before fee elimination, or other) is not publicly documented. If the loss was a one-time event, forward risk is contained; if underlying strategies continue to underperform, further losses may follow
  • Underlying asset value uncertainty (~$292M ecosystem loss unresolved): The onchain hgETH accounting (0.9941 rsETH per hgETH) is verifiable, but rsETH's market value in ETH may differ from the LRT oracle price (1.0748 ETH/rsETH). The April 18, 2026 LayerZero bridge exploit released ~116,500 rsETH (~$292M, ~18% of rsETH supply) from the OFT escrow to an attacker. Wrapped rsETH on bridged chains remains structurally under-collateralized. Recovery via the "DeFi United" Constitutional AIP is unresolved. The ultimate economic backing of hgETH depends on remediation outcomes
  • No buffer = no instant exits: With 0.745 rsETH in buffer (~0.007% of assets), even small withdrawals force strategy recall with 3-4 day delays. Any liquidity crunch (many simultaneous withdrawals) would create significant processing delays
  • Concentrated multisig with no timelock: The same 3-of-5 Safe controls pause/unpause, fee parameters, and proxy upgrades on hgETH. Despite the vault now being unpaused, the multisig retains unilateral control with no onchain delay
Full Report

Contract Addresses

Core Contracts (Ethereum)

Contract Address Type
hgETH (High Growth Vault) 0xc824A08dB624942c5E5F330d56530cD1598859fD TransparentUpgradeableProxy → GainLendingPool
rsETH (underlying asset) 0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7 Kelp liquid restaked ETH
KERNEL (governance token) 0x3f80b1c54ae920be41a77f8b902259d48cf24ccf KernelDAO governance token

Proxy Infrastructure

Contract ProxyAdmin ProxyAdmin Owner
hgETH 0xd355daae366220a0282cd5d2687fbc395395fc40 3-of-5 Multisig (0xFD96F6854bc73aeBc6dc6E61A372926186010a91)

Governance

Contract Address Configuration
Vault Owner Multisig 0x66Bee721697BF17D9Eea28c51C828a43ba597B0b 3-of-5 Gnosis Safe (onchain verified via getThreshold() and getOwners())
ProxyAdmin Owner Multisig 0xFD96F6854bc73aeBc6dc6E61A372926186010a91 3-of-5 Gnosis Safe — same 5 signers as vault owner (onchain verified)

On-Chain Verification (Etherscan + cast, April 27, 2026)

Contract Name Verified Proxy Implementation
hgETH TransparentUpgradeableProxy → GainLendingPool Yes Yes 0x4FFe25598489C7259DC9686a2Cba0507177bcf7F (unchanged from March)
BASE_FEED_1 TransparentUpgradeableProxy → EOMultiFeedAdapter Yes Yes 0x8a1bae36ee0e7b7d6ced3ffea250914bfca09292 (unchanged from March)
Vault Owner SafeProxy (Gnosis Safe) Yes Yes —
ProxyAdmin ProxyAdmin Yes No —

Onchain ownership verification (via cast, April 27, 2026):

  • hgETH owner() → 0x66Bee721697BF17D9Eea28c51C828a43ba597B0b (3-of-5 multisig, unchanged signers)
  • hgETH ProxyAdmin owner() → 0xFD96F6854bc73aeBc6dc6E61A372926186010a91 (3-of-5 multisig, same 5 signers as vault owner, unchanged)
  • Vault multisig getThreshold() → 3, getOwners() → 5 signers (unchanged)
  • ProxyAdmin multisig getThreshold() → 3, getOwners() → 5 signers (same set, unchanged)
  • No proxy upgrade since deployment (implementation slot still points to 0x4FFe25598489C7259DC9686a2Cba0507177bcf7F)
  • depositsPaused() → false, withdrawalsPaused() → false (vault UNPAUSED as of June 29, 2026; originally paused on April 18, 2026 via tx 0xec9de389a42cc3213fd1d95243a1caa3812574acb0a8012407a57411aa48fcef)
  • ⚠️ ABI Mismatch Alert (new, September 2026): The Etherscan-verified GainLendingPool ABI lists WithdrawalRequested and WithdrawalProcessed events with 4 parameters each. However, on-chain event logs show WithdrawalRequested(address,address,uint256,uint256,uint256,uint256,uint256,uint256) (8 parameters) and WithdrawalProcessed(uint256,uint256,address,uint256,bool) (5 parameters). No proxy upgrade events were detected, suggesting the verified source code may not match the deployed implementation
  • Governance dormancy (new, September 2026): The vault owner multisig has executed only 1 transaction since ~June 2025; the proxy owner multisig has executed 0 transactions in the same period

Audits and Due Diligence Disclosures

Audit History

hgETH involves multiple protocol layers, each with its own audit history.

hgETH / Gain Vault Audits

# Firm Date Scope Report
1 Sigma Prime Nov 2024 GainAdapter contract (rsETH adapter for hgETH) PDF

Key findings from Sigma Prime hgETH audit:

  • Assets held by the adapter are not included in share calculations, causing users to receive more shares per asset than they should upon deposits
  • A portion of rsETH tokens will not be accounted for by any vault and become stuck in the contract
  • Team acknowledged these as "design choices for protocol stability"

On-Chain Complexity

The architecture is highly complex with multiple layers:

  • ERC-4626 vault: hgETH wraps rsETH via the GainLendingPool implementation
  • Upgradeable proxy: TransparentUpgradeableProxy controlled by 3-of-5 multisig
  • Multi-protocol strategy: Funds deployed across 12+ DeFi protocols simultaneously
  • August subaccounts: Smart contract wallets used for strategy segregation on Upshift
  • Policy-constrained execution: Curators can only execute whitelisted strategies
  • rsETH layer: Additional complexity from the underlying liquid restaking protocol (EigenLayer integration)

Bug Bounty

Active Immunefi bug bounty program for Kelp DAO:

Note: The bug bounty covers rsETH core contracts only. hgETH/Gain vault contracts are NOT in scope — verified on Immunefi Kelp DAO scope. The 10 in-scope contracts are: LRT Config, rsETH, LRT Deposit Pool, LRT Oracle, EthXPriceOracle, FeeReceiver, LRTConverter, LRTWithdrawalManager, LRTUnstakingVault, and NodeDelegator. The hgETH contract (0xc824A08dB624942c5E5F330d56530cD1598859fD) and Upshift infrastructure are not covered. There is also no separate KernelDAO bug bounty program on Immunefi.

Insurance

Nexus Mutual embedded cover — confirmed partnership between Nexus Mutual, Edge Capital (UltraYield), and Kelp for the High Growth Vault (announcement). Described as a "world-first DeFi vault with embedded cover":

  • Cover protects across $30M+ of the vault's core positions
  • Cover is integrated directly into the vault — users receive protection as part of the product, not purchased separately
  • Nexus Mutual track record: $5.5B in crypto safeguarded since 2019, $17M+ in claims paid

What IS covered (Nexus Mutual cover terms):

  • Smart contract exploits/hacks (e.g., a bug in Aave, Euler, or the vault contract itself)
  • Oracle manipulation or oracle failure
  • Liquidation failure (when a protocol's liquidation mechanism malfunctions and bad debt accrues)
  • Governance takeovers (malicious upgrade forced through)

What is NOT covered:

  • Strategy losses from looping/leverage are NOT covered — if hgETH's leveraged looping strategy on Aave gets liquidated because ETH price drops and the health factor falls below 1, that is the protocol working as intended → not a covered event
  • Market price movements of assets (except oracle manipulation)
  • Depegs of assets that the covered protocol generates
  • Rug pulls / owner confiscation within existing permissions
  • Bridge failures
  • User errors (phishing, private key compromise, malware)
  • Pre-existing issues or previously disclosed bugs

Key distinction for Yearn: The Nexus Mutual cover protects against protocol failures (smart contract bugs, oracle malfunctions, broken liquidation mechanisms), but does not protect against strategy underperformance or losses from legitimate DeFi protocol behavior. Since hgETH's primary yield strategy involves leverage farming on Aave and looping, a normal liquidation from adverse market conditions would result in a loss to hgETH holders that insurance would not cover.

Historical Track Record

Incidents

Date Incident Impact Resolution
Apr 18, 2026 KelpDAO LayerZero V2 OFT bridge exploit — attacker forged a cross-chain message via a misconfigured 1-of-1 DVN setup on the Unichain→Ethereum rsETH route, causing the OFT escrow on Ethereum to release ~116,500 rsETH (~$292M, ~18% of supply) to an attacker address. Attacker used the rsETH as collateral to borrow ~$200–236M across lending venues. Aave's Guardian froze rsETH/wrsETH markets across 10+ deployments on the same day. rsETH on Ethereum supply unchanged onchain (escrow drain, not new mint). Wrapped rsETH on bridged chains is now ~18% under-collateralized. rsETH market peg broke versus ETH. Kelp/Upshift paused hgETH and other Gain vaults the same day as a precaution. The vault was unpaused sometime between late April and late June 2026. Arbitrum Security Council froze ~30,766 ETH (~$71M) of attacker funds on April 21. Kelp, Aave Labs, LayerZero, EtherFi, Compound jointly filed a Constitutional AIP seeking to release frozen funds into a "DeFi United" recovery vehicle. Investigation and remediation still ongoing as of June 2026.
Apr 30, 2025 rsETH fee minting bug — code used 1e36 instead of 1e18 base, minting an astronomical excess of rsETH to the fee address Deposits/withdrawals paused. rsETH frozen on Aave as precaution. No user funds lost. Bug resolved May 1, 2025. Kelp integrated Chainlink Proof of Reserve (PoR) Secure Mint
Apr 2024 rsETH depeg — -1.5% deviation from theoretical exchange rate Brief depeg, quickly corrected. Protocol monitoring paused operations when exchange rates deviated >1% ETH withdrawal feature improvements subsequently reduced depeg risk
Jul 22, 2024 DNS hijacking — attacker convinced GoDaddy to bypass 2FA and redirect domain to malicious UI A small number of users lost funds via phishing UI. No smart contract exploit. Domain ownership recovered, registrar transferred, security alerts improved

Direct hgETH/Gain vault contract impact: None of the incidents above are bugs in the hgETH or Gain vault smart contracts themselves. The April 2026 exploit was on the LayerZero OFT bridge layer; hgETH vault holds canonical rsETH on Ethereum and was paused as a precaution. The vault has since been unpaused (June 2026), but the rsETH peg break and the continued ecosystem stress materially increase redemption / liquidity risk for hgETH holders.

Funds Management

Deposit/Withdrawal Flow

Depositing: Users deposit ETH, LSTs (stETH, ETHx), or rsETH into the High Growth Vault via the Kelp Gain dApp. An adapter contract converts all deposits to rsETH before depositing into the vault. hgETH shares are minted proportional to the current exchange rate (ERC-4626 standard).

Strategy deployment: The vault curator (UltraYield by Edge Capital) allocates rsETH across ~12 DeFi protocols:

  • Leverage farming (Aave)
  • Stablecoin strategies (Usual, Elixir)
  • Fixed-yield instruments (Pendle)
  • Lending markets (Morpho, Euler, Compound)
  • Strategies execute within Upshift's August subaccount infrastructure — curators operate within policy-constrained smart contract wallets

Withdrawals (hgETH → ETH full flow, onchain verified):

hgETH → rsETH → ETH
 15-18 days    instant (DEX) or 2+ days (Kelp unstake)

Step 1: hgETH → rsETH (15-18 days)

  1. User calls requestRedeem(shares, receiver, holder) on the hgETH vault
  2. Withdrawal epoch processes on a scheduled basis
  3. Operator recalls assets from deployed strategy positions
  4. Operator calls processAllClaimsByDate(year, month, day, maxLimit) to settle
  5. User calls claim(year, month, day, receiver) to receive rsETH
  6. maxRedeem() = 0 (direct ERC-4626 redemption disabled — must use requestRedeem() flow)

Step 2: rsETH → ETH (two options)

  • Option A — DEX swap (instant): Sell rsETH on Curve/Balancer. Instant with slippage on large amounts
  • Option B — Kelp unstaking (2+ days): Submit withdrawal via LRTWithdrawalManager (0x62De59c08eB5dAE4b7E6F7a8cAd3006d6965ec16) → wait for processing → claim ETH

Total time: 15-18 days (vault + DEX) or 17-20+ days (vault + Kelp unstake). Note: the redemption period has been extended from 3-4 days to 15-18 days per the KernelDAO website (September 2026).

Vault buffer (onchain verified, September 9, 2026):

Metric Value
Total assets 5,332.92 rsETH
rsETH balance in vault contract 152.74 rsETH
Vault buffer (rsETH balance held by hgETH) 152.74 rsETH (~2.86%)
Active loan/strategy positions not independently verified (was 172 in June, 169 in April)
Settlement account (settlementAccount) 0x66Bee721697BF17D9Eea28c51C828a43ba597B0b (vault owner multisig)
Loans operator (loansOperator) 0x416e26e331Fc0b77386e9dDB5Ed9AdE73F1241F4
Loans deployer (loansDeployerAddress) 0x9E053AAA3C435e94C1663a428cdC4ea91F23C556
Scheduled caller (scheduledCallerAddress) 0x06eada250B02A3614AFce04B8cd7025093312159
GainAdapter (gainAdapter) 0xB185D98056419029daE7120EcBeFa0DbC12c283A
Max supply cap (maxSupply) 100,000 hgETH (unchanged)
Max deposit cap (maxDepositAmount) 100,000 rsETH (unchanged)

The vault buffer has increased from 0.745 rsETH (0.007%) in June to 152.74 rsETH (~2.86%) in September. However, this is largely due to the 53% reduction in total assets (from 11,275.93 to 5,332.92 rsETH) rather than an increase in liquidity. The remaining ~97% of assets are deployed in strategies. Withdrawals are unpaused, but the 15-18 day redemption period is a 4x increase from the 3-4 days reported in earlier assessments.

Accessibility

  • Deposits: Unpaused — open to anyone; deposit ETH/LSTs/rsETH, receive hgETH. Management fee is 0%
  • Withdrawals: Unpaused — 15-18 day processing period via requestRedeem() → claim() flow (not instant). This is a 4x increase from the 3-4 days reported in earlier assessments
  • Composability: hgETH can be used across DeFi for additional yield, but secondary markets are extremely thin

Fees (onchain verified, June 29, 2026)

Fee Value Mechanism
Management fee 0% (managementFeePercent() = 0, changed from 150/1.5% in April) Management fee was cut to zero by vault governance. managementFeeLastKnownTimestamp = 1774371695 (March 24, 2026 17:01:35 UTC) — fee has not been charged since. No ongoing dilution
Withdrawal fee 0% (withdrawalFee() = 0, unchanged) —
Performance fee 0% (was 20%; per KernelDAO website, September 2026) Both management and performance fees eliminated
Fee collector (feesCollector) 0x2151A97C7819782fD99efF020CdfE0aE838Ad378 Receives minted hgETH shares
Daily fee accrual 0 rsETH/day Management fee set to 0% as of June 2026
Annual fee 0 rsETH Management fee eliminated
totalCollectableFees 0 No fees accruing

Collateralization

  • Underlying asset: rsETH (Kelp liquid restaked ETH)
  • rsETH backing: ETH (~59.5%), ETHx from Stader (~32.5%), wstETH from Lido (~8%) — restaked on EigenLayer
  • hgETH backing: 1 hgETH = 0.9981 rsETH (onchain, September 9, 2026). This is a decrease from 1.035 rsETH/hgETH in March 2026 and 0.9941 in June 2026, representing a cumulative ~3.6% loss in NAV from pre-exploit levels
  • Non-custodial vault: Per Upshift documentation, neither Upshift nor the Curator can withdraw user funds to an external EOA. Funds only move between whitelisted strategy contracts and the vault
  • Withdrawal Liquidity Buffer: Configurable percentage of assets held in buffer for immediate redemptions (per Upshift docs)
  • No over-collateralization: hgETH is a 1:1 receipt token for vault shares, not an over-collateralized position

Provability

  • hgETH exchange rate: Fully onchain via ERC-4626 convertToAssets() — programmatic, trustless
  • rsETH exchange rate: Onchain via Kelp's LRT oracle
  • Strategy positions: Deployed across DeFi protocols — visible onchain via August subaccounts
  • rsETH reserves: Chainlink Proof of Reserve (PoR) integration (added May 2025 after fee minting incident)
  • Risk management: Upshift enforces NAV Volatility Protection (max percentage change constraint on share-to-asset ratio per update cycle)

Liquidity Risk

Primary Exit Mechanisms

  1. Withdrawal from vault: Unpaused as of June 2026 (withdrawalsPaused() = false). Request hgETH → rsETH redemption via Kelp Gain dApp; 3-4 day processing period as assets are recalled from strategies. However, vault buffer is nearly zero (0.745 rsETH), so even small withdrawals require strategy recall
  2. DEX swap: hgETH composability on Balancer, Pendle; rsETH has diminished DEX liquidity post-exploit (was ~$79M pre-exploit across Curve/Balancer; current depth unverified but likely still thin)
  3. Morpho/Euler: hgETH can be used as collateral on Morpho and Euler Frontier vaults, but the hgETH/WETH Morpho market is now essentially empty (see below)

Liquidity Assessment

  • Primary liquidity: Vault withdrawals are unpaused. maxRedeem() = 0 (direct ERC-4626 redemption disabled — must use requestRedeem() flow). However, the redemption period has been extended to 15–18 days (per KernelDAO website, September 2026) — a 4x increase from the 3-4 days reported previously. The vault buffer is 152.74 rsETH (~2.86% of assets), but this is largely due to the 53% reduction in total assets rather than increased liquidity
  • rsETH secondary market (post-exploit): Pre-exploit rsETH had ~$79M across major DEX pools. Post-exploit liquidity is materially diminished. Kelp TVL has recovered slightly from ~$870M (June) to ~$1.1B (September 2026) but remains down from ~$1.54B (April)
  • hgETH secondary market: Effectively zero. No meaningful DEX liquidity for hgETH. Any collateral use depends entirely on vault redemption
  • rsETH depeg risk (now realized): The April 18, 2026 LayerZero bridge exploit created a structural rsETH depeg. The bridge-induced under-collateralization (~18% on wrapped rsETH) remains unresolved
  • Morpho hgETH/WETH market (dead): The market has been almost entirely unwound. Current state (September 9, 2026): ~0.06 WETH supply, ~0.05 WETH borrow, ~83.5% utilization. The earlier concern about a liquidation cascade is resolved — there is essentially no position left to unwind. The market is effectively dormant

Morpho Market (hgETH/WETH)

Parameter Value (September 9, 2026)
Market ID 0xec97655fab06b53bfad9d8c2358768aed5a1c97b204d3e51e2a7cb0cb786a264
Collateral hgETH (0xc824A08dB624942c5E5F330d56530cD1598859fD)
Loan Token WETH (0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2)
Oracle MorphoChainlinkOracleV2 (0x56dbc0f2784cd959e57fcc9cd83c3b7a24ee678c)
IRM AdaptiveCurveIrm (0x870aC11D48B15DB9a138Cf899d20F13F79Ba00BC)
LLTV 91.5% (immutable per Morpho design)
Total Supply ~0.06 WETH (was ~495.82 WETH in April, ~0.10 in June)
Total Borrow ~0.05 WETH (was ~493.58 WETH in April, ~0.05 in June)
Utilization ~83.5% (was ~99.5% in April, ~50.7% in June)
Fee 0%

Note: The hgETH/WETH Morpho market is effectively dead. Current positions are ~0.06 WETH supply and ~0.05 WETH borrow — negligible. The earlier critical risk of a liquidation cascade against frozen exit paths no longer applies because there is essentially no position left to liquidate.

Morpho Oracle Analysis (onchain verified, June 29, 2026)

The oracle is a MorphoChainlinkOracleV2 that uses two price feeds (no vault conversion):

Parameter Address Description Current Value
BASE_VAULT 0x0 Not used —
BASE_VAULT_CONVERSION_SAMPLE — — 1
BASE_FEED_1 0x70cf192d6b76d57a46aafc9285ced110034eb013 EOMultiFeedAdapter (hgETH/USD, 18 decimals) — TransparentUpgradeableProxy ~$2,699.51
BASE_FEED_2 0x0 Not set —
QUOTE_FEED_1 0x5f4eC3Df9cbd43714FE2740f5E3616155c5b8419 Chainlink ETH/USD (8 decimals) ~$2,504.92
QUOTE_FEED_2 0x0 Not set —
SCALE_FACTOR — Decimal adjustment 1e26
price() — Final oracle price ~1.078 (hgETH/ETH ratio)

Values above are onchain verified at block 25938993 (September 9, 2026). The hgETH/USD feed latestRoundData() returns data with roundId=0, answer=~$2,699.51, and updatedAt=1788947087 (Sep 9, 2026). The ETH/USD Chainlink feed is operating normally.

Oracle architecture:

Oracle concerns:

  • Upgradeable oracle feed (unchanged): The hgETH/USD feed is a TransparentUpgradeableProxy (EOMultiFeedAdapter). The proxy admin multisig (3-of-5) could upgrade the oracle implementation. Implementation at 0x8a1bae36ee0e7b7d6ced3ffea250914bfca09292 is unchanged
  • Oracle–NAV divergence (new, September 2026): The oracle prices hgETH at ~1.078 ETH while the actual vault NAV is 0.9981 rsETH/hgETH — an ~8% overvaluation. If this market were still active, borrowers would be over-collateralized on paper but under-collateralized in reality
  • No vault conversion (unchanged): The oracle does NOT use the onchain ERC-4626 exchange rate
  • Morpho liquidation cascade risk (no longer applicable): The Morpho hgETH/WETH market is effectively dead (~0.06 WETH supply). The earlier concern about mass liquidations is resolved — there is essentially no position left to liquidate
  • Oracle proxy admin (different multisig, unchanged): ProxyAdmin owner is 0x266f15c63d5D3dE038F2E05D1fA397d92BCB013E (3-of-5 Gnosis Safe with 5 different signers from the vault multisig — onchain verified). Signers unchanged
  • Positive (unchanged): The ETH/USD quote feed is standard Chainlink with normal roundId, timestamps, and heartbeat

Centralization & Control Risks

Governance

The hgETH vault is controlled by a 3-of-5 Gnosis Safe multisig. Both the vault owner() and the ProxyAdmin are controlled by the same 5 signers:

Role Controlled By Description
hgETH owner() 3-of-5 Multisig Vault administrative operations
hgETH ProxyAdmin Owner 3-of-5 Multisig (same signers) Can upgrade hgETH implementation

Governance concerns:

  • No timelock on proxy upgrades (onchain verified): The ProxyAdmin (0xd355daae366220a0282cd5d2687fbc395395fc40) is owned directly by the 3-of-5 Safe — no TimelockController or delay contract in between. The ProxyAdmin has no getMinDelay() or delay() functions. Neither Safe has modules (getModulesPaginated() returns empty). The vault's lagDuration() = 0. Upshift documentation claims "24-hour timelocks on critical modifications" — this is not enforced onchain for proxy upgrades. The updateTimelockDuration function exists in the vault ABI but controls vault operational parameters, not proxy upgrades
  • One known signer: Only 1 of 5 signers is identifiable (Kelp DAO Deployer address). The other 4 are anonymous EOAs
  • Same signers for both owner and ProxyAdmin: No separation of concerns between operational control and upgrade authority

rsETH governance (underlying layer):

  • External Admin: 6-of-8 multisig with 10-day timelock for contract upgrades (via Timelock contract at 0x49bD9989E31aD35B0A62c20BE86335196A3135B1)
  • Manager: 2-of-5 multisig for operational tasks (deposits, limits, pausing)
  • 8 known signers on External Admin including venture partners and protocol founders (per LlamaRisk)

The rsETH layer has notably better governance than the hgETH vault layer (higher threshold, timelock, more known signers).

KERNEL token governance:

  • $KERNEL is the unified governance token (1B total supply)
  • Token distribution: 55% community rewards/airdrops, 20% private sale (18-month vesting after 12-month lock), 20% team/advisors (36-month vesting after 12-month lock), 5% ecosystem partners
  • Governance token launched April 2025; DAO structure is relatively new

Programmability

  • hgETH exchange rate: Onchain via ERC-4626 convertToAssets(). Programmatic
  • Strategy execution: Curators execute strategies within Upshift's August subaccount infrastructure. Strategies are policy-constrained (whitelisted protocols and contract calls only). Curator-managed, not fully programmatic
  • Withdrawal: 15-18 days, requires assets to be recalled from deployed strategies. Not instant, involves operational steps. 4x longer than reported in earlier assessments
  • NAV updates: Upshift enforces Max Percentage Change constraint per update cycle. Bounds checking exists
  • Emergency functions: Multi-sig controlled pause for deposits/withdrawals; can instantly return all strategy funds to vault

External Dependencies

Dependency Type Criticality Impact of Failure
rsETH (Kelp) Underlying asset Critical hgETH value directly tied to rsETH; rsETH depeg or exploit would impact hgETH
EigenLayer Restaking infrastructure Critical rsETH depends on EigenLayer; slashing or EigenLayer failure would impact rsETH
Upshift Finance Vault infrastructure Critical hgETH vault built on Upshift; Upshift vulnerability would impact all vault operations
UltraYield / Edge Capital Vault curator High Strategy execution and allocation decisions; poor decisions could lead to losses
August Subaccount infrastructure High Smart contract wallets for strategy segregation
EOMultiFeedAdapter Oracle (Morpho market) High Oracle failure could cause incorrect liquidations on Morpho
Chainlink Oracle (ETH/USD) Medium Standard Chainlink feed; well-established
Nexus Mutual Insurance Medium Loss of embedded vault cover
12+ DeFi protocols Strategy destinations Medium Exploit in any destination protocol could cause partial loss

Key dependency risk: hgETH has a deeply layered dependency chain. ETH → rsETH (Kelp + EigenLayer) → Gain vault (Upshift + August + UltraYield) → 12+ DeFi protocols. Each layer multiplies smart contract risk. The Upshift non-custodial architecture and policy constraints mitigate some curator risk, but the overall complexity is high.

Operational Risk

  • Team: Well-known founders — Dheeraj Borra and Amitej Gajjala, both previously co-founded Stader Labs ($680M+ TVL). Dheeraj: LinkedIn, Blend Labs, PayPal, IIT Kharagpur, UT Austin. Amitej: A.T. Kearney, Swiggy, IIT Madras, IIM Calcutta
  • Funding: $19M+ raised — $9M Kelp private sale (May 2024, SCB Limited, Laser Digital), $10M KernelDAO round (Nov 2024, Binance Labs, Laser Digital, Hypersphere Ventures). $40M strategic ecosystem fund
  • Legal structure: Evercrest Technologies Inc. (Andorra/India per various sources). Limited regulatory oversight
  • Documentation: Good quality — comprehensive docs across Kelp GitBook, Upshift docs, KernelDAO blog
  • Source code: rsETH contracts verified on Etherscan. hgETH implementation (GainLendingPool) verified on Etherscan. Not open source on GitHub
  • Incident response: DNS hijack resolved within hours (Jul 2024). Fee minting bug resolved within 24 hours (Apr 2025). Both incidents handled competently with no user fund loss
  • Track record: Stader Labs (predecessor project) has been running since April 2021 with $680M+ TVL. KelpDAO operational since December 2023

Monitoring

hgETH Vault Monitoring

  • hgETH contract: 0xc824A08dB624942c5E5F330d56530cD1598859fD
    • Monitor convertToAssets(1e18) for exchange rate changes
    • Alert: If exchange rate decreases further from current 0.9981 rsETH/hgETH — indicates potential loss event in underlying strategies
    • Monitor totalAssets() for large changes relative to totalSupply()
    • Monitor Transfer events for large movements
    • Alert: Single deposits/withdrawals >$500K (given ~$14.5M vault TVL)
    • Alert: ABI mismatch — verified source code event signatures do not match on-chain events

rsETH Monitoring

  • rsETH contract: 0xA1290d69c65A6Fe4DF752f95823fae25cB99e5A7
    • Monitor rsETH/ETH exchange rate for depeg events
    • Alert: If rsETH depegs >1% from theoretical exchange rate
    • Monitor Chainlink PoR feed for reserve discrepancies

Governance Monitoring

Oracle Monitoring

Monitoring Frequency

Category Frequency Priority
hgETH proxy upgrade events Real-time Critical
Multisig signer/threshold changes Real-time Critical
hgETH exchange rate decrease Every 6 hours Critical
rsETH depeg (>1%) Every 6 hours Critical
Oracle feed proxy upgrades Real-time Critical
Oracle price staleness Every 6 hours High
hgETH total assets changes Daily High
rsETH timelock transactions Real-time High
Large deposit/withdrawal events Real-time Medium
Protocol TVL changes Daily Medium

Reassessment Triggers

  • Time-based: Reassess in 3 months (December 2026) given elevated risk tier
  • Pause-state: Reassess immediately if depositsPaused() or withdrawalsPaused() flips to true again
  • Exchange-rate: Reassess immediately if hgETH convertToAssets(1e18) decreases further from current 0.9981, or if it recovers above 1.0
  • rsETH bridge remediation: Reassess on (a) Kelp publishing a final post-mortem with concrete numbers, (b) any movement on the Constitutional AIP / "DeFi United" recovery vehicle, (c) socialization or recovery transactions executed onchain
  • rsETH peg: Reassess if rsETH/ETH market price returns within 1% of Kelp's rsETHPrice() for 30 consecutive days, OR if Kelp's LRT oracle updates to reflect a new lower peg
  • Redemption period: Reassess if the redemption period changes from current 15-18 days
  • Vault buffer: Reassess if vault buffer (rsETH balance of hgETH) exceeds 5% of total assets
  • TVL-based: Reassess if hgETH vault TVL changes by >25% (below ~$11M or above ~$18M)
  • Governance-based: Reassess if an onchain timelock is verified/added for hgETH vault upgrades, or if the ABI mismatch is resolved
  • Oracle-based: Reassess immediately if the hgETH/USD oracle feed proxy is upgraded or if the oracle–NAV divergence widens
  • Fee change: Reassess if management or performance fees are reinstated (currently 0%/0%)
  • Audit-based: Reassess if additional hgETH/Gain or rsETH bridge-layer audits by tier-1 firms are completed
  • Bug bounty scope: Reassess if hgETH/Gain vault contracts are explicitly added to the Immunefi program scope

Appendix A — Related Protocol Audits

Upshift Finance (vault infrastructure) Audits

# Firm Date Scope Report
1 ChainSecurity Jan 2025 Core Vault Available
2 Hacken Sep 2025 Unknown scope Available
3 Hacken Dec 2025 Unknown scope Available
4 Hacken Jan 2026 AllocationWhitelist Available
5 Sigma Prime Aug 2024 Unknown scope Available
6 Zellic Apr 2023 Fractal Protocol (predecessor) Available

rsETH (Kelp) Audits

# Firm Date Scope Findings Report
1 Sigma Prime Dec 2023 rsETH smart contracts 2M, 3L, 5I PDF
2 Code4rena Nov 2023 rsETH system (competitive, $28K pool) 3H, 2M Report
3 MixBytes Mar 2024 rsETH + withdrawal mechanism 4H PDF
4 Sigma Prime 2024 rsETH with withdrawals Unknown PDF
5 Sigma Prime 2024 rsETH with withdrawals Unknown PDF

Notable Code4rena findings (Nov 2023):

  • H-01: Possible arbitrage from Chainlink price discrepancy (disputed by Kelp)
  • H-02: Protocol mints less rsETH on deposit than intended (fixed)
  • H-03: rsETH price manipulable by first staker via donation attack (disputed but upheld as HIGH)

Notable MixBytes findings (Mar 2024):

  • 4 HIGH severity including EigenPod initialization problem and race condition in node delegator management

Kernel (BNB Chain) Audits

# Firm Date Scope Report
1 ChainSecurity Dec 2024 Kernel smart contracts PDF
2 Bailsec Unknown Kernel platform Not publicly available
3 Sherlock Jul 2025 Slashing/restaking logic Private engagement
Score Details

Critical Risk Gates

  • No audit — Extensively audited across multiple layers: Sigma Prime (rsETH + hgETH), Code4rena, MixBytes (rsETH), ChainSecurity, Hacken, Zellic (Upshift + Kernel). Only 1 public audit specifically for hgETH/Gain (Sigma Prime). PASS
  • Unverifiable reserves — hgETH is an ERC-4626 vault wrapping rsETH. Both exchange rates are verifiable onchain. Strategy positions are onchain in DeFi protocols. rsETH has Chainlink PoR (though PoR did not prevent the LayerZero bridge exploit, since the issue was on the OFT messaging layer, not on Ethereum-side mint accounting). PASS
  • Total centralization — 3-of-5 multisig for hgETH, 6-of-8 multisig with 10-day timelock for rsETH. Not a single EOA. PASS

All gates pass. Proceed to category scoring. Note: the April 18, 2026 incident does not trigger a hard auto-fail (the bug was not in hgETH/Gain contracts and reserves remain verifiable), but it materially increases risk in several categories.

Category Scores

Expand a category to see how it was scored.

Audits & Historical Track Record20%3.50
  • Audits: 5+ audits for rsETH from 3 reputable firms (Sigma Prime, Code4rena, MixBytes). 1 public audit for hgETH/Gain vault (Sigma Prime, Nov 2024). 6+ audits for Upshift (ChainSecurity, Hacken, Sigma Prime, Zellic). No new hgETH-specific audit found since Nov 2024
  • Bug Bounty: Active Immunefi program with $250K max for rsETH core contracts only. hgETH/Gain vault contracts are not in scope (verified on Immunefi). No separate KernelDAO bounty exists. Bridge / OFT messaging configuration was also not in any auditable scope — the misconfigured 1-of-1 DVN was an operational/deployment choice
  • Time in Production: KelpDAO ~28 months (since Dec 2023). Founders' prior project (Stader) since Apr 2021. hgETH deployed November 19, 2024 (~17 months onchain)
  • TVL: ~$19M hgETH market cap (down from ~$37M in April, from price decline and continued redemptions). Kelp ecosystem TVL down to ~$870M (from $1.54B in April). Gain protocol TVL at ~$33.6M near all-time low
  • Incidents (now THREE, including a ~$292M direct ecosystem loss; plus a realized ~4.1% hgETH share-value decrease of unknown cause):
    • DNS hijack (Jul 2024) — ops issue, resolved
    • rsETH fee-minting bug (Apr 2025) — caught before fund loss, resolved
    • LayerZero OFT bridge exploit (Apr 18, 2026) — ~116,500 rsETH (~$292M) released from escrow. Not an hgETH bug, but the largest crypto exploit of 2026 in the same ecosystem. Operational cause: misconfigured 1-of-1 DVN on the Unichain→Ethereum route

Score: 3.5/5 (was 3.5 in April) — Unchanged. No new audits, same bug bounty limitations. The realized hgETH share-value loss of ~4.1% is a new adverse data point, but the vault being unpaused and operational partially offsets this from a track-record perspective. TVL continues to decline.

Centralization & Control Risks30%3.67

Subcategory A: Governance

  • 3-of-5 multisig for hgETH vault (4 anonymous signers, 1 known deployer) — unchanged
  • ProxyAdmin controlled by same 3-of-5 multisig (same signers) — unchanged
  • No verified onchain timelock on the hgETH ProxyAdmin (Upshift docs claim 24-hour timelocks; not verified onchain)
  • The same 3-of-5 multisig has unilateral control over pause/unpause — vault was paused from April 18, 2026 until some point before June 29, 2026; now unpaused
  • rsETH layer: 6-of-8 multisig with 10-day timelock (unchanged) — but the LayerZero OFT bridge configuration that was exploited was an operational/deployment setting outside this timelock
  • $KERNEL governance token launched April 2025 (DAO still maturing)

Governance Score: 3.5 (was 3.5) — Unchanged. The vault being unpaused is a return to the prior operational state, not a governance improvement. The governance structure is identical: same 3-of-5 multisig with 4 anonymous signers, same no onchain timelock, same unilateral control over pause/unpause. The April 2026 incident demonstrated that the multisig can and will pause the vault — the fact that it was later unpaused does not reduce the structural centralization risk.

Subcategory B: Programmability

  • hgETH exchange rate: onchain via ERC-4626. Programmatic
  • Strategy execution: curator-managed via Upshift, policy-constrained but not fully automated
  • Withdrawals: unpaused as of June 2026. When active, 3-4 day processing period required
  • NAV bounds checking: automated guards against anomalous exchange rate changes
  • Emergency pause: multi-sig controlled — was active April 18 until ~June 2026

Programmability Score: 3.5 (was 3.5) — Unchanged. Vault is now unpaused and operational, which is an improvement, but the 3-4 day withdrawal cycle and curator-managed strategy execution remain. The realized exchange-rate decrease suggests NAV protection may not have caught the loss event.

Subcategory C: External Dependencies

  • Critical: rsETH (Kelp), EigenLayer, Upshift Finance, LayerZero OFT messaging (now demonstrably failed)
  • High: UltraYield/Edge Capital (curator), August (subaccounts), EOMultiFeedAdapter (oracle)
  • Medium: 12+ DeFi destination protocols, Chainlink, Nexus Mutual
  • The Kelp/LayerZero relationship is no longer a benign dependency — a misconfiguration there caused the largest single-protocol crypto exploit of 2026 and directly stresses the hgETH underlying asset

Dependencies Score: 4.0 (was 3.5) — Heavy dependency chain that has now produced a real, large-magnitude failure outside hgETH's direct contracts. Curator and Upshift architectural mitigants remain, but cross-chain messaging risk is elevated.

Centralization Score = (3.5 + 3.5 + 4.0) / 3 = 3.67

Score: 3.67/5 (was 3.67) — Unchanged. The governance, programmability, and dependency architecture are all the same as in April. The vault unpause is operational restoration, not a structural governance improvement. The heavy dependency chain and demonstrated cross-chain failure keep this category elevated.

Funds Management30%4.00

Subcategory A: Collateralization

  • hgETH is a 1:1 ERC-4626 receipt token for rsETH deposited in the vault — onchain accounting unchanged
  • rsETH is nominally backed by ETH/LSTs restaked on EigenLayer, but the LayerZero OFT escrow leaked ~116,500 rsETH (~18% of supply) to an attacker on April 18, 2026. Wrapped rsETH on bridged chains is now under-collateralized; ultimate impact on the rsETH/ETH backing ratio depends on remediation outcomes (recovery, socialization, etc.)
  • Vault positions deployed across well-known DeFi protocols (172 active loans)
  • Non-custodial: curators cannot extract funds to external EOAs (architecture unchanged)
  • Realized onchain loss: The hgETH exchange rate decreased from 1.0368 to 0.9941 rsETH/hgETH (~4.1% loss). This is visible onchain and represents a concrete decrease in per-share asset backing
  • Management fee cut to 0% by governance — eliminates ongoing fee dilution, but the circumstances are not publicly explained
  • Nexus Mutual embedded cover for $30M+ of vault positions exists, but cover scope is for protocol-level smart-contract exploits, oracle failures, and liquidation mechanism failures. Bridge / cross-chain messaging failures (the actual April 2026 cause) are likely outside the Nexus cover terms based on standard exclusions

Collateralization Score: 4.25 (was 4.0) — Worsened. The ~4.1% per-share loss (1.0368 → 0.9941 rsETH/hgETH, onchain verified) is no longer a feared risk but a realized, confirmed decrease in backing — and its cause is undocumented, so forward risk is unbounded. An ERC-4626 share should never fall in value absent a loss event; that this one did, with no published explanation, materializes the exact risk the prior 4.0 was hedging against. The unresolved rsETH bridge under-collateralization (~18%) compounds it.

Subcategory B: Provability

  • hgETH exchange rate: fully onchain (ERC-4626) — unchanged
  • rsETH exchange rate: onchain via Kelp's LRT oracle (rsETHPrice() = 1.0748 ETH/rsETH) — increased slightly from April (1.0696), but this oracle has not been adjusted for the bridge-induced under-collateralization
  • Chainlink PoR was added to rsETH after the April 2025 incident, but the April 2026 exploit was not on the mint path on Ethereum — it was on the cross-chain release path, where PoR did not detect or prevent the issue
  • Strategy positions: onchain in DeFi protocols (transparent)
  • NAV updates: bounded, with anomaly detection — but the anomaly that occurred (cross-chain backing loss) is not visible to the vault's NAV checks

Provability Score: 3.75 (was 3.5) — Worsened. Two new provability regressions this period: (1) the share value fell for an undocumented reason — holders cannot prove what caused their backing to drop; and (2) the hgETH/USD oracle feed is degraded — latestAnswer() now reverts onchain (verified June 29, 2026), and latestRoundData() returns anomalous zero-filled fields (roundId=0, startedAt=0). The onchain exchange rate is transparent, but the meaningful question — "what is the economic value of my rsETH, and why did it drop?" — is less provable than in April.

Funds Management Score = (4.25 + 3.75) / 2 = 4.0

Score: 4.0/5 (was 3.75) — Worsened. The realized, undocumented per-share loss and the degraded oracle feed both push this category up. The management fee elimination is nominally positive, but its circumstances are unexplained and coincide with the loss, so it does not offset.

Liquidity Risk15%4.25
  • Exit mechanism: Restored — withdrawalsPaused() = false as of June 2026. Withdrawal requires requestRedeem() flow (maxRedeem() = 0), 3-4 day processing period. maxWithdrawalAmount() = 100,000 rsETH per request. However, vault buffer is nearly zero (0.745 rsETH), so any withdrawal >0.745 rsETH requires strategy recall
  • rsETH DEX liquidity: Pre-exploit ~$79M across Curve and Balancer pools. Current depth not verified in this reassessment but presumed diminished given Kelp TVL decline from $1.54B to $870M
  • hgETH DEX liquidity: Negligible — was ~$311K in a single Uniswap V4 pool. Not reverified; presumed thin given ~40% Gain TVL decline
  • rsETH depeg (structural): The April 2026 bridge exploit created sustained rsETH/ETH peg stress. LRT oracle price has not adjusted downward (1.0748 ETH/rsETH), but market price likely trades at discount
  • Morpho market: Previously a critical risk at 99.5% utilization. Now essentially empty (~0.1 WETH supply) — the liquidation cascade risk is resolved
  • Same-denomination: hgETH → rsETH → ETH. All notionally ETH-denominated, but the rsETH/ETH peg remains uncertain

Score: 4.25/5 (was 4.5) — Marginal improvement only. The vault unpause makes exit technically possible, but instant-exit capacity actually deteriorated ~150×: the buffer fell from 117.13 rsETH (0.77%) to 0.745 rsETH (0.007% of assets). Any withdrawal above 0.745 rsETH still requires a 3-4 day strategy recall, so for any redemption of meaningful size the practical exit is barely better than the paused state. DEX liquidity remains negligible, the rsETH peg is structurally uncertain, and the hgETH/USD oracle feed is degraded. The unpause earns only a 0.25 reduction from the April 4.5, not a full half-point.

Operational Risk5%3.25
  • Team: Both founders publicly known with strong credentials (Stader Labs, LinkedIn, PayPal, IIT). Well-funded ($19M+)
  • Curator: UltraYield by Edge Capital — professional crypto fund manager
  • Documentation: Good quality across Kelp GitBook, Upshift docs, KernelDAO blog
  • Legal Structure: Evercrest Technologies Inc. (Andorra). Limited regulatory oversight
  • Source code: Contracts verified on Etherscan but not open source on GitHub
  • Incident response (April–June 2026): Operations multisig paused rsETH and hgETH within an hour of detection (April 18). Coordination with Aave Labs, LayerZero, Arbitrum, EtherFi, Compound. Vault was eventually unpaused. Management fee cut to 0% suggests restructuring. However, the exchange rate decrease (~4.1%) and the cause of that loss have not been publicly explained
  • Root cause (April 2026, unchanged): 1-of-1 DVN configuration on a production OFT route — serious deployment/configuration failure

Score: 3.25/5 (was 3.0) — Worsened. Team credentials and the April incident response remain credible, but a new adverse, opaque event occurred this period: an unexplained ~4.1% share-value loss plus an undocumented restructuring (management fee cut 1.5% → 0% with no published rationale, coinciding with the loss). Unexplained loss-and-restructuring during a pause is a fresh operational-transparency negative, not merely a wash against the unpause.

Final Score Calculation

Final Score = (Centralization × 0.30) + (Funds Mgmt × 0.30) + (Audits × 0.20) + (Liquidity × 0.15) + (Operational × 0.05)
Category Score (Sep 2026) Score (Jun 2026) Score (Apr 2026) Weight Weighted (Sep 2026)
Audits & Historical 3.5 3.5 3.5 20% 0.700
Centralization & Control 3.67 3.67 3.67 30% 1.101
Funds Management 4.0 4.0 3.75 30% 1.200
Liquidity Risk 4.25 4.25 4.5 15% 0.638
Operational Risk 3.25 3.25 3.0 5% 0.163
Final Score 3.80

Final Score: 3.80/5.0 (was 3.80/5.0 in June 2026, 3.75/5.0 in April 2026, 2.8/5.0 in March 2026). Subcategory means are used directly; no half-point bucketing.

September 2026 assessment: The score is unchanged from June 2026. Mixed developments since June:

  • Positive: Exchange rate slightly recovered (0.9941 → 0.9981 rsETH/hgETH). Kelp TVL recovered from ~$870M to ~$1.1B
  • Negative: Total supply collapsed a further 53% (11,343 → 5,343 hgETH). Redemption period extended 4x (3-4 days → 15-18 days). Both management and performance fees eliminated. Morpho market further declined (0.10 → 0.06 WETH supply). New findings: ABI mismatch between verified source and on-chain events, governance dormancy (minimal multisig activity for 6+ months), and oracle-NAV divergence (~8%)

The 15-18 day redemption period is a material deterioration in liquidity risk that offsets the slight exchange rate improvement. The fee elimination may signal curator distress. The ABI mismatch and governance dormancy raise new transparency concerns.

Risk Tier

Final Score Risk Tier Recommendation
1.0-1.5 Minimal Risk Approved, high confidence
1.5-2.5 Low Risk Approved with standard monitoring
2.5-3.5 Medium Risk Approved with enhanced monitoring
3.5-4.5 Elevated Risk Limited approval, strict limits
4.5-5.0 High Risk Not recommended

Final Risk Tier: Elevated Risk

Practical recommendation: The vault is unpaused and operational, but the extended 15-18 day redemption period, continued supply collapse, and unresolved rsETH bridge situation warrant continued caution. Any Yearn exposure should (a) account for the 15-18 day withdrawal lag, (b) remain ready to exit if the rsETH situation deteriorates further, and (c) be sized conservatively given the ~$14.5M vault TVL. The Morpho hgETH/WETH market is effectively dead and should not be relied upon as a liquidation venue.

hgETH is an actively managed ERC-4626 vault token built by a well-funded, experienced team (KelpDAO / Stader Labs founders) on established infrastructure (Upshift Finance). The protocol benefits from extensive auditing, an active bug bounty (rsETH only), Nexus Mutual embedded cover, and non-custodial vault architecture that prevents curator fund extraction.

The original assessment (March 2026, score 2.8 — Medium Risk) flagged three concerns: layered smart-contract risk, an upgradeable oracle for the Morpho market, and weaker governance on the hgETH layer than on rsETH. The April 18, 2026 LayerZero OFT bridge exploit (~116,500 rsETH / ~$292M released from escrow) materialized exactly the "tail event in a layered dependency chain" risk the prior report warned about. The bug was not in hgETH/Gain code, but cascading effects on the rsETH peg and hgETH operations were material.

As of June 2026, the picture is mixed — operationally restored, but with a realized loss and weakened backing:

  • The hgETH vault is unpaused — deposits and withdrawals are operational again
  • The hgETH/WETH Morpho market has been almost entirely unwound (<0.1 WETH supply, <0.05 WETH borrow) — the earlier liquidation cascade concern is resolved
  • However, the hgETH exchange rate decreased ~4.1% (1.0368 → 0.9941 rsETH/hgETH), representing a realized share-value loss whose cause is undocumented
  • The vault buffer is near zero (0.745 rsETH), meaning all withdrawals require 3-4 day strategy recall
  • The underlying rsETH bridge exploit remains unresolved, and Kelp TVL continues to decline
  • The hgETH/USD oracle feed is degraded (latestAnswer() reverts)

For the Yearn use case (hgETH as collateral or in a strategy), the current state is functional but risky:

  • The vault is accessible for deposits and withdrawals
  • The Morpho market is effectively dormant and should not be relied upon for liquidation
  • The near-zero buffer means even modest Yearn withdrawals would face 3-4 day delays
  • The unexplained share-value loss raises questions about strategy performance transparency
  • The unresolved rsETH bridge situation creates ongoing underlying asset uncertainty

Recommendation: Limited exposure is now technically feasible (vault unpaused), but should be conservative given the near-zero buffer, unexplained loss, and rsETH uncertainty. Position sizing should account for the 3-4 day withdrawal lag and remain small relative to the ~$11.3M vault TVL.

Key conditions for any exposure:

  • Monitor depositsPaused() / withdrawalsPaused() (currently false, false — vault operational)
  • Monitor hgETH exchange rate (convertToAssets(1e18)) for further decreases — currently 0.9981 rsETH/hgETH
  • Monitor vault buffer (rsETH.balanceOf(hgETH)) — currently 152.74 rsETH (~2.86% of assets)
  • Monitor rsETH/ETH market vs. rsETHPrice() from Kelp's LRT oracle
  • Monitor hgETH proxy for implementation upgrades (no verified timelock — instant once executed)
  • Monitor the hgETH/USD Morpho oracle feed proxy (0x70cf192d6b76d57a46aafc9285ced110034eb013) for implementation upgrades
  • Investigate the ABI mismatch — verified source code event signatures do not match on-chain events
  • Monitor both vault and oracle Safes for signer/threshold changes — note governance dormancy (minimal activity for 6+ months)
  • Note: No onchain timelock exists on hgETH ProxyAdmin despite Upshift documentation claims — proxy upgrades are instant
  • Both management and performance fees are now 0% (was 1.5%/20%)
  • Position sizing should remain very conservative; current hgETH supply is ~5,343 hgETH (~$14.5M vault TVL)

Assessment History

DateScoreNotes
September 9, 20263.8Initial assessment
Submit report inaccuracy