DefiLlama rebuts Aave TVL inflation; Chaos Labs under scrutiny

DefiLlama’s founder rejected claims that the platform inflated Aave’s total value locked after Aave’s TVL fell from $26.4 billion on April 18 to roughly $17 billion following a $292 million exploit of KelpDAO. At the same time, scrutiny has shifted to Chaos Labs over the deployment configuration used for rsETH on LayerZero.

The TVL decline accelerated after the April 18 exploit as projects with exposure to rsETH and other bridged assets reassessed risk. DefiLlama’s charts showed a sharp fall in Aave balances, prompting questions about whether data platforms might count looped or recycled liquidity that could increase reported lending-pool size.

DefiLlama founder 0xngmi responded on X, rejecting the looping claims and describing the platform’s accounting rules. He wrote, “Seeing a lot of takes that assume that Defillama’s Aave TVL is inflated by looping. That’s NOT the case, because borrowed coins are removed from TVL.” He explained that when a user deposits an asset and another user borrows against related collateral, the borrowed amount is netted out and not counted twice. DefiLlama also flagged Ethena as a specific case where looping expanded reported deposits and said it removed those deposits from Aave’s TVL.

On-chain analysts proposed additional transparency, including a view that isolates how much of a lending protocol’s TVL comes from looped liquidity. Those researchers have argued looped value should be shown separately because it represents different risk characteristics. There is no public evidence that DefiLlama’s current TVL methodology produced incorrect figures.

Attention has moved to Chaos Labs, which Aave engages as a risk manager. An AI agent deployed by aixbt labs wrote that “Chaos Labs is paid $2.4m per year as Aave’s risk manager and never once checked that rsETH was running a 1/1 DVN config on LayerZero before approving it at 75% LTV.” The agent added that “That single oversight enabled $236 million in bad debt.” About 68% of participating Aave governors supported a review or replacement of Chaos Labs.

The dispute focuses on a deployment configuration known as a 1/1 DVN, a single-verifier setup for LayerZero cross-chain messages. That configuration means messages rely on one verification node. The bridge adapter code uses standard LayerZero boilerplate; the concern centers on the verifier setup, which is part of deployment and operational risk rather than the smart-contract code that audits typically examine.

LayerZero has announced it will stop signing messages for applications that use a 1/1 DVN configuration and is urging teams to migrate to multi-DVN arrangements that require multiple verifiers. Aave launched V4 on Ethereum mainnet on March 30. A claim that V4 will relaunch on April 30 with collateral rules that could render $4 billion to $6 billion of bridged assets ineligible unless protocols meet a 3/5 DVN minimum remains unverified.

Critics of current risk-management arrangements pointed to incentives and liability limits in contracts and payment structures. An AI agent asserted risk managers had “zero skin in the game, zero financial liability, zero incentive to dig deeper than a Peckshield audit and a Chainlink oracle check,” suggesting contractual terms may affect the depth of deployment and bridge-configuration reviews.

The record available to date includes the technical detail that DefiLlama’s TVL methodology excludes borrowed tokens and a specific adjustment for Ethena, plus governance actions and vendor review calls related to Chaos Labs. Protocol stakeholders and community members continue to press for clearer standards on verifier setups and collateral eligibility for bridged tokens.