Aave: $26 million in wrongful liquidations triggered by oracle error

Aave, a DeFi lending protocol, suffered an oracle error that led to the wrongful liquidation of positions worth about $26 million.

According to The Block on the 10th (local time), Aave said a temporary oracle error on the Ethereum network caused some users’ positions to be liquidated incorrectly. The incident occurred on the Ethereum Core and Prime instances.

Around 34 accounts were affected, with about 10,938 positions liquidated. Total losses are estimated at roughly $26 million.

Chaos Labs, Aave’s risk-management partner, said the incident was caused by a configuration mismatch in the Correlated Asset Price Oracle (CAPO). Because the snapshot ratio and snapshot timestamp were misaligned, the oracle reflected an exchange rate lower than the actual rate.

At the time, the exchange rate applied by the oracle was about 1.1939, calculated below the actual market price of roughly 1.228. As a result, some positions were mistakenly deemed at risk, triggering automatic liquidations.

Chaos Labs said it attempted to adjust the snapshot ratio to about 1.2282 during off-chain operations, but on-chain rules allow the value to be increased by no more than 3% every three days, preventing a one-shot update. This caused the exchange rate used by the protocol to be calculated about 2.85% lower, ultimately triggering large-scale liquidations.

Third-party liquidators earned profits of about 499 ETH from the incident. However, Chaos Labs said no protocol-level bad debt was incurred.

Aave said it resolved the issue by temporarily lowering the wstETH borrowing cap and manually adjusting oracle snapshot values. A process to compensate affected users is also under way.

Compensation will be funded using 141.5 ETH recovered during the incident and up to 345 ETH from the Aave DAO treasury.