Aave Oracle Malfunction Triggers $26M in Erroneous wstETH Liquidations

Oracle Mispricing Triggers $26M Liquidation Cascade

On March 10, Aave — one of the largest DeFi lending protocols — experienced a significant oracle malfunction that resulted in approximately $26 million worth of erroneous liquidations of wstETH positions.

The issue stemmed from a misconfiguration of the Correlated Asset Price Oracle (CAPO), a safeguard mechanism designed to protect the protocol from sharp price swings. According to risk analysts at Chaos Labs, a data desynchronization caused CAPO to register the asset's exchange rate at 1.1939 instead of its actual value of 1.228.

Why This Matters

Aave is a cornerstone of the DeFi ecosystem. Just last February, it became the first decentralized finance protocol to surpass $1 trillion in cumulative loan volume. An oracle failure at this scale raises critical questions about the reliability of pricing mechanisms even within the most established protocols. Such incidents erode user confidence and highlight the inherent risks of automated collateral management systems.

Root Cause: Update Procedure Conflict

The malfunction originated from an error during a routine update. An off-chain algorithm attempted to adjust price quotations in a single operation, but failed to account for a smart contract limitation: the parameter can only be increased by a maximum of 3% every three days.

This conflict between the update algorithm and the on-chain rate cap caused the effective exchange rate within the protocol to drop by 2.85%, which automatically triggered a cascade of forced liquidations.

Scope of the Damage

The incident affected 34 user accounts. The system forcibly sold 10,938 wstETH. Third-party liquidators who capitalized on the pricing error earned approximately 499 ETH in profits.

Chaos Labs confirmed that the incident did not create any bad debt for the Aave protocol — all liquidations were fully covered by collateral.

Response and Compensation Plan

The development team moved quickly to contain the situation. Immediate countermeasures included:

• Temporarily reducing borrowing limits for wstETH
• Manually correcting the oracle parameters

Aave is now preparing a compensation package for affected users. Losses will be covered through 141.5 ETH recovered after the incident, supplemented by up to 345 ETH allocated from the DAO treasury.

The team emphasized that the underlying oracle architecture remains secure. The failure was caused solely by a configuration conflict during the update process, not by a fundamental vulnerability in the system's design.