[Security Disclosure] Kiln precautionary out of order exits in response security incident

Node Operators
1

Following an investigation yesterday regarding a Solana incident involving SwissBorg, Kiln has decided to take precautionary measures to safeguard client assets across all networks it runs validators in. As part of this response, Kiln today began the orderly exit of all of its Ethereum (ETH) validators, including validators run using the Lido protocol. The exit process is a precautionary measure designed to ensure the integrity of the staked assets. stETH holders do not need to perform any action, and the ETH exited from Kiln-related validators is expected to flow back into the protocol gradually once the relevant validators have completed the exit and withdrawal cycle (which is estimated to take roughly 15-45 days). Please refer to the Kiln press release for more information.

Lido DAO contributors are actively working with Kiln in investigating the incident to understand its full scope, and more information will be shared in the coming days/weeks as the process runs its course.

See also

14 Likes
2

Following the same precautionary measures, Kiln and Lido contributors working together, would like to suggest to rotate Kiln’s key in the Deposit Security Committee ( Deposit Security Committee manual | Lido Docs ). The goal is to preserve Kiln’s participation in the Committee while ensuring the security of its operations. This will be included in the next on-chain Aragon vote.

4 Likes
3

Kiln is rotating its key in the Deposit Security Committee:

5 Likes
4

Assuming conservatively around 15 days of lost income (entry queue + withdrawal delay) and 6900? keys to cycle, this will cost the protocol over 240 ETH. Will kiln be reimbursing us for the losses?

1 Like
5

The Vote #192 has started!

Besides other voting items, it contains a Dual Governance proposal with a Kiln guardian rotation in the Deposit Security Committee.

The vote will be open for your “For” or “Against” input until the end of the main phase: Sep 26, 15:32 UTC. For instructions on how to verify the vote items, please follow this guide.

6

Hi @stakey

This is a valid concern, however we are not in a position to answer until withdrawals have completed. On the Kiln side we commit to:

1. Working with the Lido Analytics workstream on computing the exact amount of lost rewards
2. Sharing a postmortem note, including action points proposed, seeking the Lido DAO approval for future steps related to the Lido protocol participation and reduced rewards from the validator exits.

Please stay tuned for more updates from us on this, thanks for your patience.

2 Likes
7

The Vote #192 was passed, and Dual Governance Proposal #5 was executed!

The Kiln guardian address is now rotated in the Deposit Security Committee!

Voting stats:

“No” — 1 (0.01%)

“Yes” — 55,433,862 (5.54%)

8

Hi all,

We have published a new blog post on the incident and Kiln’s remediations plan here, please stay tuned for further updates.

https://www.kiln.fi/post/re-enablement-of-kiln-services-and-security-incident-information

Thank you

4 Likes