Key Highlights
- Aave glitch caused $26M in accidental liquidations due to a mismatch in wstETH price data.
- CAPO system’s snapshot ratio and timestamp misalignment triggered a 2.85% artificial price drop.
- Affected users will be fully reimbursed; Aave recovered 141 ETH and covers the rest via DAO funds.
A glitch on the Aave platform caused $26 million in accidental liquidations yesterday, sparking concern across the DeFi community. The problem mainly involved wstETH, a token from Lido that represents staked ether.
According to blockchain data from Chaos Labs, there was a sudden spike in liquidations of 34 accounts. The cause of this was due to the mismatch between on-chain smart contract configurations and off-chain calculations. This caused the price of wstETH to be 2.85% lower than it actually was.
This was caused by an issue in Aave’s CAPO system, which is intended to prevent price manipulation. CAPO is intended to control the rate at which token prices change. It does this using a “snapshot ratio” and a timestamp to calculate the highest valid exchange rate.
In this case, the snapshot ratio couldn’t update fully because of a 3% on-chain limit, but the timestamp still reflected a week-old value. This mismatch caused the system to treat the token as cheaper than it really was, leading to the liquidations.
As a result, the system applied a lower-than-market exchange rate, pushing healthy positions into liquidation. “A technical misconfiguration resulted in the liquidation of positions that were already close to their liquidation thresholds,” Aave CEO Stani Kulechov explained on X.
How the glitch happened
CAPO functions as a hybrid oracle system, combining offchain calculations with smart contract validation. Offchain, Chaos Labs computed the correct wstETH snapshot ratio of ~1.2282, matching the seven-day-old exchange rate. However, on-chain constraints allowed only an increase to ~1.1919.
Meanwhile, the snapshot timestamp assumed full seven-day growth. This mismatch led CAPO to calculate a maximum rate below the live market rate, creating an artificial 2.85% drop that triggered liquidations in E-Mode.
Omer Goldberg, Founder of Chaos Labs, noted: “Risk oracles are critical infrastructure for Aave and have secured hundreds of billions in loans, liquidations, and markets since go-live. All affected users will be fully reimbursed.” Aave has already recovered 141 ETH through BuilderNet refunds and plans to cover the remaining 204 ETH via DAO treasury funds.
Immediate response and recovery
Aave acted quickly to stop more problems from happening. They temporarily lowered borrowing limits for wstETH to prevent further liquidations. The team manually adjusted the system so the snapshot ratio matched the timestamp, bringing the token price back in line. The platform didn’t lose any funds, and the extra profits that liquidators gained—about 345 ETH—will be returned to the affected users.
A similar incident like this happened last year in November on Moonwell, a DeFi lending protocol operating on Base and Optimism. The protocol clarified the misreported oracle price for wrsETH, denying reports of a hack.
The incident emphasizes the need to effectively manage oracle systems for DeFi protocols, especially for tokens earning staking rewards over time.
Also Read: Aave Proposes New Licensing Framework for V4 Codebase
