Audits Aren't Enough: Why RPC Security Needs to Level Up

TL;DR

Magma Devs is partnering with Hashlock, Hacken, Hexens, and Cyfrin to help close RPC security gaps in the industry.

Take 5 minutes to check your exposure to RPC attacks.

The exploit that didn't break a contract

The $292M KelpDAO exploit didn't break a smart contract. KelpDAO's OFTAdapter passed its audit. So did LayerZero's contracts.

A lot went wrong. The attackers, attributed by LayerZero to the Lazarus Group, appear to have gained deep access to LayerZero's internal infrastructure, possibly through social engineering or a separate compromise. From there, they were able to poison the RPC nodes feeding LayerZero's verifier, while DDoS'ing the clean ones to force failover. KelpDAO's 1-of-1 DVN setup did the rest.

There's no single root cause here. Internal access controls, operational security, DVN configuration, and RPC integrity all failed in sequence. RPC security wasn't the only layer that broke, but it is a fundamental security layer that was lacking, and allowed an internal compromise to turn into a $292M loss.

The attack surface is moving

The web3 security iceberg: smart contract audits are the visible tip; operational security, organizational cybersecurity, and RPC security sit below the waterline. Hexens, Cyfrin, Magma Devs, Hashlock, and Hacken are partnering to address the full stack.

For years, smart contract audits have been treated as the bar for security. They are necessary, and they are not sufficient. Modern DeFi protocols and crypto-native financial institutions are built on top of off-chain infrastructure that gets nowhere near the same scrutiny as the code itself: key management, cybersecurity posture, operational practices, and increasingly - the RPC layer.

Every DVN or other on-chain component ultimately operates based on RPC data. If those sources are compromised or share substrate, everything built on top is potentially compromised as well.

Most applications don't have sufficient guards in place to validate RPC data before it is being acted on.

How exposed is your RPC stack?

Take the 2-minute Secure RPC Assessment and get a personalized risk report.

Run the assessment

Frequently Asked Questions

If a protocol passed a smart contract audit, is it secure?

Not necessarily. A clean audit confirms the on-chain code behaves as intended, but it says nothing about the off-chain infrastructure the contract depends on: key management, operational security, and the RPC layer feeding it data. In the KelpDAO exploit, both KelpDAO's OFTAdapter and LayerZero's contracts had passed audits, yet the attackers never touched the contract code.

What is the RPC security gap?

It's the part of the stack that sits below smart contract audits and rarely gets the same scrutiny: the RPC nodes that supply blockchain data to your application or verification system. If those sources are compromised, DDoS'd, or swapped, everything built on top can inherit bad data, even when the contracts are flawless.

Why aren't smart contract audits enough on their own?

Audits are necessary but not sufficient. Modern DeFi and crypto-native institutions run on off-chain infrastructure such as RPC endpoints, verifier configurations, and internal access controls that an audit doesn't examine. The attack surface has shifted from contract logic to the data and infrastructure those contracts trust.

How can teams close the RPC security gap?

By not trusting a single RPC source by default. That means cross-validating responses across independent providers, requiring both internal and external nodes to agree before acting on data, and adding observability so anomalies surface early. Smart Router provides this validation layer in front of your existing providers.