An investor lost $50 million in a failed token swap on Aave, only receiving tokens worth $36,000 due to a MEV bot's "sandwich attack."
A significant incident in the decentralized finance (DeFi) space occurred when an anonymous user attempted to exchange over $50 million worth of USDT for AAVE tokens but ended up with only 327 AAVE, valued at approximately $36,000. The transaction took place via the CoW Protocol aggregator and SushiSwap.
This unfortunate event was exacerbated by a "sandwich attack" executed by a miner-extractable value (MEV) bot. The bot monitored the pending transaction and took the following steps:
- Secured a $29 million flash loan in WETH on Morpho;
- Purchased a substantial amount of AAVE on Bancor, which inflated the asset's price;
- Allowed the original user's swap to proceed at this elevated price;
- Sold its AAVE on SushiSwap, earning a profit of nearly $9.9 million.
User Accountability and Protocol Responses
Aave's founder, Stani Kulechov, noted that the platform had issued warnings about substantial slippage due to the size of the order. Despite this caution and a requirement for confirmation, the investor proceeded with the transaction using a mobile device.
"A user attempted to buy AAVE using $50M USDT through Aave’s interface. Given the large size of the single order, we warned the user about extraordinary slippage and required confirmation via a checkbox," stated Kulechov on Twitter.
In light of this incident, Kulechov indicated that Aave would assist the affected user by refunding $600,000 in fees incurred during the transaction. The CoW DAO also pointed out that the investor had been informed about the potential loss of nearly all funds prior to finalizing the deal, emphasizing that such a large order could not have been executed at a reasonable price on any decentralized exchange.
"Warnings were provided indicating the risks, yet the user approved the transaction," the CoW Protocol account stated on Twitter.
The developers expressed concerns over the overall user experience within DeFi, asserting that improvements are needed to ensure user safety while maintaining autonomy. They reiterated their commitment to refund all fees related to this transaction.
This incident follows an earlier episode where an MEV bot intercepted $200,000 from participants in a PROMPT airdrop by Wayfinder, underscoring ongoing vulnerabilities in the DeFi ecosystem. Ethereum co-founder Vitalik Buterin has flagged MEV as a critical threat to the decentralization of the network.
