Chaos Labs: Aave's $27M Liquidation Caused by CAPO Risk Oracle Configuration Issue

iconChaincatcher
Share
Share IconShare IconShare IconShare IconShare IconShare IconCopy
AI summary iconSummary

expand icon
Chaos Labs reported that Aave's $27M liquidation resulted from a misconfiguration in the CAPO risk oracle. The snapshotRatio parameter failed to reach its target due to a 3% daily cap, while the snapshotTimestamp was set seven days in the past. This caused a 2.85% undervaluation of the exchange rate, triggering the liquidation of approximately 10,938 wstETH. ETH update: Parameters were manually realigned via the Risk Steward, and 141.5 ETH was recovered through BuilderNet. BTC update: Remaining losses were covered by Aave’s treasury, with compensation estimated at no more than 345 ETH. No bad debt was incurred.

According to a report released by Chaos Labs, the recent $27 million liquidation event on Aave was caused by a misconfiguration in the CAPO risk oracle. The root cause was inconsistent update constraints at the smart contract level: the snapshotRatio parameter was subject to an on-chain constraint limiting it to a maximum 3% increase every 3 days, preventing it from directly updating from approximately 1.1572 to the target value of 1.2282—it could only rise to about 1.1919. Meanwhile, the snapshotTimestamp was successfully updated to a timestamp from 7 days ago. This mismatch between the ratio and timestamp caused CAPO to calculate an exchange rate ceiling of approximately 1.1939, which was about 2.85% below the actual market rate, triggering the liquidation of approximately 10,938 wstETH. The protocol incurred no bad debt. Chaos Labs and BGD Labs immediately reduced the wstETH borrowing limit on affected instances to 1 and manually realigned the parameters via Risk Steward to restore the correct exchange rate. Through BuilderNet, 141.5 ETH has been recovered and will be used to compensate affected users; the remaining amount will be covered by the Aave treasury, with an estimated temporary compensation required from the DAO not exceeding 345 ETH.

Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information. Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.