{"id":95251,"date":"2026-03-16T11:43:00","date_gmt":"2026-03-16T08:43:00","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=95251"},"modified":"2026-03-16T11:45:22","modified_gmt":"2026-03-16T08:45:22","slug":"50-million-loss-aave-blames-user-cow-swap-cites-algorithm-failure","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/50-million-loss-aave-blames-user-cow-swap-cites-algorithm-failure\/","title":{"rendered":"$50 Million Loss: Aave Blames User, CoW Swap Cites Algorithm Failure"},"content":{"rendered":"<p>The projects <a href=\"https:\/\/forklog.com\/en\/news\/what-is-aave\">Aave<\/a> and CoW Swap have offered differing accounts of an incident in which a user <a href=\"https:\/\/forklog.com\/en\/news\/investor-loses-50-million-in-token-swap-on-aave\">lost<\/a> over $50 million during a token exchange.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">CoW&#8217;s Account<\/h2>\n<p>The aggregator&#8217;s team believes the failed transaction with AAVE was due to a combination of factors:\u00a0<\/p>\n<ul class=\"wp-block-list\">\n<li>a &#8220;fill or kill&#8221; order on an illiquid pair with a massive volume;<\/li>\n<li>an outdated gas limit in the verification system;<\/li>\n<li>a solver unable to execute the transaction;<\/li>\n<li>a potential data leak from the private mempool.<\/li>\n<\/ul>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zxx\" dir=\"ltr\"><a href=\"https:\/\/t.co\/1JJhoyi3Pd\">https:\/\/t.co\/1JJhoyi3Pd<\/a><\/p>\n<p>\u2014 CoW DAO (@CoWSwap) <a href=\"https:\/\/twitter.com\/CoWSwap\/status\/2032959076502581623?ref_src=twsrc%5Etfw\">March 14, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>During the quote request stage, three solvers offered prices. The best of these suggested about $5 million AAVE for $50 million \u2014 a loss of around 90%. The verification system, with a strict limit of 12 million gas (outdated code, as explained by CoW), filtered out these options.\u00a0<\/p>\n<p>The only quote that passed verification from Solver A offered approximately 329 AAVE \u2014 150-200 times worse than the unverified alternatives. This formed the basis of the order&#8217;s limit price.<\/p>\n<p>Upon execution, the situation worsened. Solver E found a more advantageous route and won two auctions, but no transaction was included in the block. After two failures, it ceased participation, leaving only a weak solver with the worst price in play.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p><em>&#8220;The auction lacks a mechanism to track such a scenario,&#8221; CoW noted.<\/em><\/p>\n<\/blockquote>\n<p>Developers also noted a potential data leak from the mempool. The transaction was sent via private <span data-descr=\"Remote Procedure Call \u2014 remote procedure call\" class=\"old_tooltip\">RPC<\/span>, but it was marked &#8220;confirmed in 30 seconds.&#8221; This occurs if the transaction is spotted in the public queue before being included in a block. The investigation is ongoing.\u00a0<\/p>\n<h2 class=\"wp-block-heading\">Aave&#8217;s Account<\/h2>\n<p>Aave believes the main causes of the incident were market illiquidity and the user&#8217;s own choices. The report reconstructed the transaction route: the solver converted aEthUSDT to <a href=\"https:\/\/forklog.com\/en\/news\/what-is-tether-usdt\">USDT<\/a> via Aave V3, then exchanged it for WETH on Uniswap V3, and finalized the operation through a SushiSwap pool with only $73,000 in liquidity.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"zxx\" dir=\"ltr\"><a href=\"https:\/\/t.co\/UmXulxU7NS\">https:\/\/t.co\/UmXulxU7NS<\/a><\/p>\n<p>\u2014 Aave (@aave) <a href=\"https:\/\/twitter.com\/aave\/status\/2032959512244518962?ref_src=twsrc%5Etfw\">March 14, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>The team noted: the widget displayed a warning &#8220;high price impact (99.9%)&#8221; and required a consent checkbox. The user confirmed the operation from a mobile device. The funds are still available to him, but he has not made contact.<\/p>\n<p>In response, Aave launched Aave Shield. This new feature blocks any exchange operations with a price impact above 25% by default. The protection can only be disabled manually in the settings.<\/p>\n<p>Previously, the project&#8217;s founder, Stani Kulechov, mentioned plans to return about $600,000 in fees. In the latest publication, the figure was adjusted to $110,368 (25 basis points). The accuracy of the amount is confirmed by CoW Swap aggregator metadata.<\/p>\n<p>This sum has also become a point of contention within the Aave community. Since December 2025, governance participants <a href=\"https:\/\/forklog.com\/en\/news\/conflict-erupts-in-aave-community-over-50-million-proposal\">have been unable to decide<\/a> whether to allocate the funds to the general <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-dao-decentralised-autonomous-organisation\">DAO<\/a> treasury or to the address of developers from Aave Labs.<\/p>\n<h2 class=\"wp-block-heading\">The MEV Factor<\/h2>\n<p>Notably, official publications do not mention <a href=\"https:\/\/forklog.com\/en\/news\/what-is-mev-in-ethereum\">MEV<\/a> bots, which gained the most from the trader&#8217;s error. According to Arkham, the Titan Builder algorithm extracted about $34 million in ETH. Another bot gained $9.9 million from a successful sandwich attack.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">Titan Builder extracted $34M worth of ETH out of this debacle<\/p>\n<p>They immediately sent all proceeds to Coinbase <a href=\"https:\/\/t.co\/B9j8p2czTD\">https:\/\/t.co\/B9j8p2czTD<\/a> <a href=\"https:\/\/t.co\/5Ll8mZxiEB\">pic.twitter.com\/5Ll8mZxiEB<\/a><\/p>\n<p>\u2014 Emmett Gallic (@emmettgallic) <a href=\"https:\/\/twitter.com\/emmettgallic\/status\/2032189975781929076?ref_src=twsrc%5Etfw\">March 12, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>CoW limited itself to mentioning a &#8220;significant <span data-descr=\"a type of hacking attack or trading strategy in DeFi, where an attacker executes a transaction immediately after a victim's large trade to profit from the price change\" class=\"old_tooltip\">backrun<\/span>&#8221; and listed addresses, but did not use the term &#8220;sandwich&#8221; or disclose the mechanics. Meanwhile, CoW Swap&#8217;s integration was positioned as protection against MEV.<\/p>\n<p>Back on March 10, Aave <a href=\"https:\/\/forklog.com\/en\/news\/oracle-malfunction-in-aave-leads-to-26-million-liquidations\">experienced<\/a> an oracle failure. It led to erroneous liquidations of positions in the wstETH token amounting to about $26 million.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The projects Aave and CoW Swap have offered differing accounts of an incident in which a user lost over $50 million during a token exchange.\u00a0<\/p>\n","protected":false},"author":1,"featured_media":95252,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Aave and CoW Swap dispute over a $50 million token exchange incident.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1212,1093],"class_list":["post-95251","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-aave","tag-defi"],"aioseo_notices":[],"amp_enabled":true,"views":"125","promo_type":"1","layout_type":"1","short_excerpt":"Aave and CoW Swap dispute over a $50 million token exchange incident.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/95251","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=95251"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/95251\/revisions"}],"predecessor-version":[{"id":95253,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/95251\/revisions\/95253"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/95252"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=95251"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=95251"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=95251"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}