Feature or Flaw? Aave Left With $1.7M in Bad Debt
Aave may have avoided a crisis for now, but changes to the protocol may be necessary to prevent a similar exploit
WindAwake/Shutterstock.com
An unidentified trader, believed to be Mango Markets exploiter Avraham Eisenberg, accumulated a roughly 92 million token loan of CRV, the native token of Curve Finance, over a period of six days. But rather than pay back the loan, the trader allowed a total of about $63.6 million in USDC collateral to be liquidated, Tuesday.
Assets on Aave each have a liquidation threshold — a percentage at which a loan will be considered undercollateralized if reached.
In this latest case, the liquidation threshold for USDC was 88%, which meant that once the value of the borrowed CRV rose above 88% of the USDC collateral supplied to Aave, liquidators stepped in to sell the USDC, buy back CRV and close the debt position.
But there was a problem: There wasn’t enough CRV liquidity to allow that to happen expeditiously. Instead, the position was closed over the course of 50 minutes through 385 individual mini-liquidation transactions.
This left Aave with 2.64 million CRV, roughly $1.7 million, in bad debt — borrowed CRV that will never be repaid.
An Aave team member said that this deficit can be covered with the protocol’s treasury holdings.
Aave’s native token (AAVE) dipped to roughly $50 as the protocol began to accrue bad debt, but has since fully recovered, trading at almost $56 at the time of writing, according to data compiled by Blockworks.
This latest exploit, however, poses a big question for Aave, Matt Fiebach, a Blockworks research analyst, said.
“The scary part about the situation is not that Aave took a hit for $1-$2 million in bad debt but rather the same design flaw is exploitable with other tokens,” Fiebach said.
Blockworks asked Eisenberg if, in his view, Aave was vulnerable to a similar attack, to which he responded, “I do not view this as an attack on either side.”
Eisenberg declined to comment further on his role in the trades, if any, except to note, “it’s a matter of public record that a founder of Curve had a nine-figure, leveraged-long CRV position on Aave.”
Last week, Eisenberg called Curve a “ponzi,” deriding its CRV-emitting liquidity incentive mechanism. Curve’s founder, Michael Egorov, is known to have a nine-figure CRV stash on deposit in Aave that could become vulnerable if the price of CRV fell sharply.
Although it is uncertain what the next steps for Aave are, the protocol tweeted that the community would be initiating discussion in response to this incident.
It is possible that the protocol will make changes to its liquidation threshold — as proposed by community contributor monetsupply — as a lower liquidation threshold correlates to less bad debt collected.
The community could also choose to implement limitations on the number of illiquid coins that can be borrowed on the platform.
Another option is to curtail rehypothecation.
Unlike some other lending markets such as Fraxlend or Silo, Aave rehypothecates collateral posted by its clients — meaning that it uses tokens posted on its platform and lends them out to others.
Although this increases capital efficiency — as more tokens can be borrowed — the protocol then faces the risk of not being able to liquidate collateral in the event of a price drop.
The Aave community will likely be implementing short-term action to prevent further exploits.
“Speed is [essential] on this issue,” community member jarnMod wrote. “Please consider quick and decisive reaction to the problem…If you can’t solve it [outright], at least mitigate this risk or communicate more.”
An Aave spokesperson declined to comment beyond the public tweets on the incident.
This story was updated on Nov. 22, 2022, at 6:15 pm ET.
Macauley Peterson contributed reporting.
Get the news in your inbox. Explore Blockworks newsletters:
- The Breakdown: Decoding crypto and the markets. Daily.
- Empire: Crypto news and analysis to start your day.
- Forward Guidance: The intersection of crypto, macro and policy.
- 0xResearch: Alpha directly in your inbox.
- Lightspeed: All things Solana.
- The Drop: Apps, games, memes and more.
- Supply Shock: Bitcoin, bitcoin, bitcoin.
