Kelp DAO (rsETH) Review
A long audit record and two published exit routes
of 10
Kelp DAO's rsETH scores 5.4/10 in liquid restaking after a re-score from current sources: 11 linked audits and two published exit routes, against a risk page that never mentions restaking slashing and a fee no longer stated in its docs. Bridging was cut back after the April 2026 exploit. Basis: desk research and on-chain reads, 1 November 2026.
Score
5.4/10: (4 + 2 + 7 + 5 + 9) / 5, re-scored from 5.0
Protocol fee
500 bps (5%) of rewards, read on-chain; not stated in the docs
Withdrawal
Standard 15–21 days, free; instant under 2 minutes, 0.5%
Licence
BUSL-1.1, licensor Kelp DAO; GPL v3 from 31 Dec 2028
Audits
11 reports, Dec 2023 to May 2026, four named firms
April 2026 exploit
116,500 rsETH released from the Ethereum bridge lockbox
Scores
Each criterion carries equal weight. The overall score is the average of these 5 scores — (4.0 + 2.0 + 7.0 + 5.0 + 9.0) ÷ 5 = 5.4.
Pros
- Audits: 11 linked reports from Sigma Prime, Code4rena, MixBytes and Bailsec, plus an Immunefi bounty
- Exit: free 15 to 21 day standard withdrawal and a 0.5% instant route, both published
- Licence file read directly: BUSL-1.1, converting to GPL v3 on 31 December 2028
- Protocol fee readable on-chain: 500 basis points (5%) of rewards on 1 November 2026
Cons
- Risk page never mentions slashing or insurance
- Commission: no reward fee is stated in the current documentation, and one fee setter now bypasses the timelock
- Standard withdrawal now takes 15 to 21 days, and exits run only on Ethereum
- April 2026 bridge exploit released 116,500 rsETH; bridging on 20+ networks retired since
Kelp's rsETH scores 5.4 out of 10 in liquid restaking, re-scored from current sources on 1 November 2026, up from 5.0. Kelp is now one of the products run under KernelDAO; its site and documentation have moved to kerneldao.com. Several facts behind the marks have changed since the review was first written, most of them after the 18 April 2026 bridge exploit.
Status after the April 2026 bridge exploit
On 18 April 2026 a forged cross-chain message was accepted by the rsETH bridge, and 116,500 rsETH were released from the Ethereum bridge lockbox to an attacker-controlled address. In its incident response the next day, Kelp said the compromised verification infrastructure was run by a third-party provider. It also said the assets backing rsETH minted on Ethereum, the rsETH contract and the EigenLayer deposits were intact. This review does not assess where fault lay.
Kelp then cut back its cross-chain footprint. Bridging of the old rsETH on more than 20 networks was retired on 15 June 2026. On 5 October 2026, rsETH on Base, Mantle and Ink moved to Chainlink CCIP and the old tokens there were retired. Holders of the old rsETH can recover it through a manual process until 15 June 2027. On Ethereum the protocol is operating: the rsETH oracle was not paused on 1 November 2026, and it reported 1.0835 ETH per rsETH.
How Kelp DAO scores in liquid restaking
| Criterion | Finding (checked 1 Nov 2026) | Mark |
|---|---|---|
| Commission clarity | Marked on a 10% fee on ETH-deposit rewards. The current documentation states no reward fee. The protocol's config contract returned a protocol fee of 500 basis points (5%) of rewards on 1 November 2026. The oracle code takes that fee by minting rsETH. | 4 |
| Slashing & risk disclosure | The risk page lists smart-contract risk and EigenLayer deposit caps. It does not mention slashing or insurance. | 2 |
| Exit & redemption | Withdrawals on Ethereum only. A standard withdrawal is free and takes 15 to 21 days. An instant withdrawal takes under two minutes and costs 0.5%, subject to available funds. | 7 |
| Licence & code openness | The LICENSE file is Business Source License 1.1, licensor Kelp DAO. It converts to GNU GPL v3 on 31 December 2028. | 5 |
| Audit disclosure | The audits page links 11 reports dated December 2023 to May 2026, by Sigma Prime, Code4rena, MixBytes and Bailsec. A bug bounty runs on Immunefi. | 9 |
The arithmetic: (4 + 2 + 7 + 5 + 9) / 5 = 27 / 5 = 5.4.
What changed: audit disclosure rose from 5 to 9 now that the audits page lists 11 reports by four named firms. Exit rose from 6 to 7 now that an instant route with a stated time and fee is documented. Commission fell from 7 to 4 because the 10% figure is no longer published; the 5% rate the contracts apply can be read only on-chain. Slashing disclosure and licence are unchanged.
Strongest criteria: audits and exit
Audit disclosure (9) reflects 11 linked reports dated December 2023 to May 2026, by Sigma Prime (five), Code4rena, MixBytes and Bailsec (three), plus a bug bounty. That matches the category's standard for four named firms with published reports, below the 10 given to peers with six or more. An audit does not cover bridge configuration, so the April exploit is not something this criterion measures.
Exit & redemption (7) reflects two routes, each published with a time and a fee: a free standard withdrawal of 15 to 21 days, and an instant one in under two minutes for 0.5%, subject to available funds. The standard wait is twice the 7 to 10 days the review first recorded, and exits run only on Ethereum, which keeps the mark below the top.
Weakest criteria: slashing disclosure and commission
Slashing & risk disclosure (2) is a deficiency, not something we failed to measure. The risk page can now be read in full. It covers smart-contract bugs and the possibility of EigenLayer deposit caps, and nothing on restaking slashing, which is the risk this rubric weighs most heavily. Kelp names the node operators that restake to AVSs on its behalf, but it does not explain what those AVSs can slash or how a loss would reach rsETH holders. No insurance is described.
Commission clarity (4) now matches the category's mark for a fee that exists as an on-chain parameter rather than a published figure. The 10% the review cited no longer appears in the documentation. The rate the contracts apply, 500 basis points (5%) of rewards on 1 November 2026, can be read from the config contract but is not stated on any Kelp page. Kelp's own upgrade log also records that one contract's fee setter was moved out from behind the timelock "for faster fee adjustments without timelock delay", so at least one fee can change without advance notice.
Licence (5) is the rubric's mid-table mark for a delayed-open licence, and the file confirms it: BUSL-1.1, converting to GPL v3 on 31 December 2028.
What the score does not cover
- Incident history and bridge design. The April 2026 exploit and the network retirements are reported above but carry no mark; no criterion in this rubric scores them.
- Admin controls and timelocks, and the KERNEL token.
- Returns, points or secondary-market pricing of rsETH.
- Hands-on use. The basis is desk research from Kelp's documentation and blog, its repository and an on-chain read of the fee and oracle.
For how bridged tokens add a separate layer of risk, see how blockchain bridges work. For how fees and exit delays reduce returns, see staking returns after costs.
Kelp DAO vs Symbiotic and Swell Restaking
Peer figures are the scores published on the liquid restaking ranking on 1 November 2026. Symbiotic (6.6) finishes 1.2 points ahead. Commission is level at 4. Kelp leads on exit (7 against 5). Symbiotic leads on slashing disclosure (7 against 2), licence (7 against 5) and audits (10 against 9).
Swell Restaking (4.6), another consumer token restaked on EigenLayer, finishes 0.8 points lower. Swell leads on commission (7 against 4), because it publishes its fee, and on slashing (3 against 2). Kelp leads on exit (7 against 6), licence (5 against 1) and audits (9 against 6).
Who this rating suits
The score helps a reader compare what rsETH discloses on fees, exits, licensing and audits against other liquid restaking tokens. Anyone holding rsETH outside Ethereum should first check which version of the token they hold and whether it falls under Kelp's recovery program; the score says nothing about that. Nothing here is a recommendation to buy, hold or sell rsETH.
How it compares
Renzo (ezETH)
Fee split and withdrawal delays published layer by layer
ether.fi (eETH / weETH)
A long audit record and plain slashing disclosure
YieldNest (ynETH)
Open BSD code backed by a long list of dated audits
EigenLayer
A long audit record and plain slashing disclosure
Symbiotic
Audit disclosure and documented slashing mechanics
Mellow
Audit disclosure: dated reports from six firms on one page
Swell Restaking (rswETH)
A 10% reward fee that matches the live contract setting
Eigenpie (mLRT)
A published fee and three linked audits; exits paused
Sources
Scored from published primary sources rather than hands-on use. Every figure above comes from one of the pages below, on the date shown. Manufacturers change prices and specifications without notice — if something here no longer matches the source, tell us and we will correct it.
- 1.Kelp docs — restaking guide (withdrawals) — checked
- 2.Kelp docs — instant withdrawals — checked
- 3.Kelp docs — risk and disclaimer — checked
- 4.Kelp docs — audits — checked
- 5.Kelp docs — upgrades log — checked
- 6.Kelp docs — oracle and exchange rate — checked
- 7.Kelp docs — bug bounty — checked
- 8.Kelp DAO — rsETH LICENSE (BUSL-1.1) — checked
- 9.Kelp DAO — LRTOracle source (protocol fee minting) — checked
- 10.Etherscan — Kelp LRTOracle — checked
- 11.Etherscan — Kelp LRTConfig (protocolFeeInBPS) — checked
- 12.Kelp — incident response, 19 April 2026 — checked
- 13.Kelp — recovering rsETH from sunset networks (12 Oct 2026) — checked
Frequently asked questions
Why does Kelp DAO score 5.4?
It is the plain average of five equally weighted marks: 4 for commission, 2 for slashing disclosure, 7 for exit, 5 for licence and 9 for audits. Audits and exit lift it; the slashing mark pulls it down.
Why did Kelp's score change from 5.0?
Audits rose from 5 to 9 once the full list of 11 reports could be read, and exit rose from 6 to 7 with the instant route documented. Commission fell from 7 to 4 because the 10% fee is no longer published; the 5% rate can be read only on-chain.
What holds Kelp's score back the most?
Slashing disclosure. Kelp's risk page covers smart-contract risk and EigenLayer deposit caps but says nothing about slashing by the services its operators restake to, and nothing about insurance.
Did the April 2026 exploit change Kelp's score?
No. The rubric has no criterion for incident history or bridge design, so the exploit is reported on this page but not scored. Kelp says the assets backing rsETH on Ethereum were untouched.
How does Kelp compare with Symbiotic and Swell Restaking?
Symbiotic's published score is 6.6, 1.2 points ahead, mainly on slashing disclosure, while Kelp leads on exit. Swell Restaking's is 4.6: it publishes its fee but trails Kelp on exit, licence and audits.
Nothing here is financial advice. Editorial policy · How we score · How we're funded.