On March 10, the DeFi protocol Aave experienced an oracle failure that resulted in erroneous liquidations of positions in the wstETH token amounting to approximately $26 million.
The issue arose from a misconfiguration of the Correlated Asset Price Oracle (CAPO), a protective mechanism designed to shield the protocol from sharp price fluctuations. According to risk managers at Chaos Labs, due to data desynchronization, the tool recorded the asset's price at 1.1939 instead of the actual 1.228.
The incident was caused by an error during an update: the on-chain algorithm attempted to adjust the quotes all at once without considering a smart contract limitation that allows the parameter to be increased by a maximum of 3% every three days. As a result, the effective exchange rate in the protocol dropped by 2.85%, triggering a cascade of liquidations.
The failure affected 34 accounts, leading the system to forcibly sell 10,938 wstETH. External liquidators profited approximately 499 ETH from the error. Chaos Labs emphasized that the incident did not create insurmountable debts for Aave.
The team quickly resolved the issue by temporarily lowering borrowing limits for wstETH and manually adjusting the oracle parameters.
Currently, the project is preparing a compensation plan. Affected users will be reimbursed from 141.5 ETH recovered after the incident, along with up to 345 ETH allocated from the DAO treasury. The team noted that the underlying architecture of the oracles is secure, and the failure was solely due to a configuration conflict.
As a reminder, in February, the total loan volume on Aave surpassed $1 trillion, making it the first project in the decentralized finance industry to reach this milestone.