Decentralized finance protocol Aave said it is introducing a new feature to block swaps with a price impact above 25% after a user lost $50 million in a trade while interacting with Aave’s interface last week.
“We are soon deploying a new feature, Aave Shield, which provides more protections for users who use the swap feature in the Aave interface aave.com,” Aave said in a post-mortem statement on Saturday.
Aave said users would need to manually disable the Aave Shield protection feature to proceed with high-risk trades.
The incident occurred on Thursday, when the user went to convert $50.4 million worth of USDt (USDT) for Aave (AAVE) via decentralized exchange CoW Swap, but received only $36,500 worth of Aave due to a lack of liquidity and other infrastructure failures, generating a loss of just over $50 million.
Part of this loss was also a result of a Maximal Extractable Value (MEV) bot that executed a sandwich attack on the user, profiting nearly $10 million.
User ignored multiple warning signs
Aave said the user signed the transaction despite multiple warnings appearing on the platform’s interface.
This included alerts about a “high price impact” and a notice stating the route might return less due to low liquidity or small order size.
The user also ticked a confirmation box stating, “I confirm the swap with a potential 100% value loss,” Aave said.
Incident shows DeFi still needs work: CoW DAO
While Aave and CoW DAO, the team behind CoW Swap, said poor liquidity led to the “extreme price impact,” CoW DAO added that multiple infrastructure failures also played a role.
CoW DAO said a solver — a third-party service that finds the best way to do a trade — was affected by an outdated gas limit, which blocked better-priced quotes and left only a much worse option for the user to consider.
One solver, which had a far cheaper price quote, also failed to submit the transaction onchain when they had the opportunity, CoW DAO noted.
Related: Venus Protocol hit by $3.7M in ‘supply cap’ attack
CoW DAO said a possible mempool leak may have contributed to the $50 million price quote.
“We do not have final answers on all of the issues surfaced above yet,” CoW DAO said, adding that it is “committed to working through them transparently, with Aave and with the broader community.”
Magazine: What’s a ‘Network State’ and are there real-life examples? Big Questions