On March 10, the DeFi protocol Aave experienced an oracle malfunction. This resulted in erroneous liquidations of wstETH token positions amounting to approximately $26 million.
The issue arose from incorrect settings in the Correlated Asset Price Oracle (CAPO), a mechanism designed to protect the protocol from sharp price fluctuations. According to risk managers from Chaos Labs, due to data desynchronization, the tool recorded the asset’s rate at 1.1939 instead of the actual 1.228.
The incident was caused by an error during an update: an off-chain algorithm attempted to adjust the quotes simultaneously. It failed to account for a smart contract limitation: the parameter can be increased by a maximum of 3% every three days. Consequently, the effective exchange rate in the protocol dropped by 2.85%, triggering a cascade of liquidations.
The malfunction affected 34 accounts. The system forcibly sold 10,938 wstETH. External liquidators profited approximately 499 ETH from the error. Chaos Labs emphasized that the incident did not create bad debt for Aave.
The team promptly resolved the issue. Developers temporarily reduced borrowing limits for wstETH and manually adjusted the oracle parameters.
The project is currently preparing a compensation plan. Affected users will be reimbursed with 141.5 ETH recovered after the incident, and up to 345 ETH will be allocated from the DAO treasury. The team noted that the fundamental architecture of the oracles is secure, and the malfunction was solely due to a configuration conflict.
In February, the total loan volume on Aave surpassed $1 trillion, marking the first time a project in the decentralized finance industry has reached this milestone.