What happened
On March 10, 2026, a configuration error in Aave V3's CAPO price adapter made wstETH look about 2.85% less valuable than it was on the Ethereum Core and Prime markets. Leveraged wstETH/ETH E-Mode positions fell below their liquidation thresholds, and liquidators closed 34 accounts, taking about 10,938 wstETH (roughly $26-27 million in liquidation volume). No attacker was involved and the protocol took no bad debt.
Liquidators captured about 116 ETH in bonuses and fees plus about 382 ETH from the price gap. Chaos Labs, Aave's risk manager, said every affected user would be fully reimbursed from about 141.5 ETH of BuilderNet refunds, recovered liquidation fees, and DAO treasury funds for the rest.
How it happened
- CAPO caps how fast a yield-bearing token's exchange rate can grow. It does this using a stored
snapshotRatioand itssnapshotTimestamp, and on-chain rules limitsnapshotRatioto about a 3% rise per three days. - Chaos Labs' off-chain risk oracle tried to raise
snapshotRatiofrom about 1.1572 to about 1.2282, a 7-day-old wstETH/stETH rate. The on-chain limit only let it reach about 1.1919. snapshotTimestamphas no such limit and moved all the way to the 7-day-old reference. That paired a low ratio with a recent timestamp.- The capped rate came out at about 1.1939 while the real rate was about 1.228. Aave therefore priced wstETH about 2.85% too low.
- High-LTV wstETH/ETH E-Mode positions became liquidatable. Liquidation bots seized collateral from 34 accounts until the Risk Steward cut the wstETH borrow cap to 1 and set
snapshotRatioto match the timestamp.
Protocol details
Security review history
- Sherlock View report
- PeckShield View report
- ConsenSys Diligence View report
Evidence
- report @yieldsandmore incident report x.com
- report Post-mortem: Exchange Rate Misalignment on wstETH Core and Prime Instances governance.aave.com
- report Aave post-mortem details wstETH liquidation wave crypto-economy.com
- analysis DeFiLlama defillama.com
- analysis DeFi lending platform Aave sees $27 million liquidations after wstETH price glitch coindesk.com
- analysis Aave price outlook after oracle glitch triggers $27M liquidations (Invezz) tradingview.com
- analysis aave.com page aave.com aave.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
