Aave and CoW Swap clash over a $50 million user loss, citing different causes for the failed transaction.
Aave and CoW Swap are at odds over the circumstances surrounding a massive $50 million loss incurred by a user during a token exchange. The incident has sparked discussions regarding the roles of both platforms and the factors contributing to the transaction failure.
CoW Swap's Perspective
CoW Swap's team attributes the failed transaction to several issues, including:
- An "execute or cancel" order placed on an illiquid trading pair with significant volume;
- An outdated gas limit in the verification system;
- A solver that failed to execute the transaction;
- Possible data leakage from the private mempool.
During the initial phase of the transaction, three solvers provided quotes, but the verification system's outdated gas limit filtered out better options, leaving only a significantly inferior quote from Solver A. This resulted in a loss of approximately 90% for the user.
CoW noted that a solver found a more favorable route but failed to execute, leading to complications in the auction process. They also indicated that a potential data leak might have compromised the transaction's integrity, stating, “There is no mechanism in the auction to track such a scenario.” An investigation is currently underway.
Aave's Explanation
Aave's team believes the incident was primarily due to market illiquidity and the user's decision-making. They traced the transaction's path, which involved converting aEthUSDT to USDT through Aave V3, exchanging it for WETH on Uniswap V3, and then finalizing the operation on a SushiSwap pool that had limited liquidity of $73,000.
Aave pointed out that their interface had warned the user about a high price impact of 99.9%, which required confirmation before proceeding with the transaction. Despite the warning, the user completed the transaction from a mobile device, and although the funds remain accessible, he has not reached out for assistance.
In response to the incident, Aave introduced Aave Shield, a feature designed to prevent transactions with a price impact exceeding 25%, with users having the option to disable it manually.
Aave also revised its plans to return approximately $110,368 in fees related to the incident, a figure confirmed by CoW Swap's metadata. This decision has sparked debate within the Aave community regarding the allocation of the funds.
Market Manipulation Concerns
Interestingly, neither project has discussed the involvement of miner extractable value (MEV) bots, which profited significantly from the situation. Reports indicate that one bot, Titan Builder, made around $34 million from the transaction, while another bot earned nearly $10 million through a sandwich attack.
CoW only acknowledged a significant backscreen but did not elaborate on the mechanics of the MEV exploitation. Notably, CoW Swap was initially integrated as a protective measure against MEV-related issues.
This incident follows a previous oracle failure on March 10 that resulted in erroneous liquidations of wstETH positions worth approximately $26 million, highlighting ongoing vulnerabilities in the decentralized finance space.
