Background and Context: The Role of Oracles in DeFi Lending
Aave is a non-custodial liquidity protocol enabling crypto asset lending and borrowing. Its operations rely on external data feeds, oracles, which bridge off-chain data to on-chain smart contracts to determine the real-time value of collateral and borrowed assets.
The incident involved $wstETH (wrapped staked Ethereum), a liquid staking derivative from Lido Finance, whose value is closely pegged to $ETH.
Timeline and Technical Details of the Glitch
The oracle glitch stemmed from an issue within Aave's CAPO (Collateral Asset Price Oracle) system. Aave employs a multi-layered oracle system, including Chainlink and its proprietary CAPO, to aggregate price data. The CAPO system experienced an error in setting the price range for the $wstETH:$USD pair. This misconfiguration led to an incorrect final aggregated price being fed to the liquidation engine, overriding potentially correct prices from other components.
The misconfiguration caused the oracle to report an incorrect, undervalued exchange rate for $wstETH. This led to healthy collateralized positions being incorrectly identified as undercollateralized and subsequently liquidated by Aave's automated mechanisms. Lido Finance confirmed the issue was isolated to the Aave CAPO oracle's pricing mechanism, unrelated to the underlying $wstETH asset or the Lido protocol, stating $wstETH's integrity as a liquid staking derivative remained unaffected. The CAPO oracle's mispricing was swiftly identified and addressed, but not before automated liquidations occurred.
Market and Sentiment Impact
Sentiment scores for news articles covering the event ranged from -12 to -85, reflecting significant negative sentiment within the crypto community. The $AAVE token experienced a 0.3% decrease over 24 hours following the incident, and a 4.3% decline over seven days.
Current State: Compensation and Protocol Integrity
Compensation will be sourced from the Aave network’s treasury, supplemented by any confiscated tokens from the incident.
Despite the financial impact on individual users, the Aave protocol did not incur any bad debt, as erroneous liquidations were executed according to the oracle's faulty data.