Connect with us

Crypto World

DeFi User Loses $50.4M in One Swap as MEV Bots and Protocol Failures Collide

Published

on

Brian Armstrong's Bold Prediction: AI Agents Will Soon Dominate Global Financial

TLDR:

  • A DeFi user lost $50.4M swapping aEthUSDT for aEthAAVE after confirming a 99.9% price impact warning.
  • CoW Swap’s legacy gas ceiling and solver failure forced the trade through a $73K illiquid SushiSwap pool.
  • A mempool leak exposed the transaction, letting an MEV bot execute a sandwich attack for $9.9M profit.
  • Titan Builder extracted ~$34M in ETH, while Aave and CoW Swap have since patched their security gaps.

A DeFi user suffered approximately $50.4 million in losses from a single swap on the Aave platform. The user exchanged aEthUSDT for aEthAAVE through a CoW Swap widget and received only $36,000 in return.

Both Aave and CoW Swap have released detailed post-mortem reports on the incident. The reports cite a combination of user error, illiquid markets, and multiple technical failures.

MEV bots also exploited the situation, extracting tens of millions in profit from the DeFi trade.

How a Series of Technical Failures Enabled the Loss

The user manually confirmed a “High price impact (99.9%)” warning before completing the DeFi swap. Aave’s report confirmed this warning was clearly visible within the interface. The trade proceeded regardless, setting the stage for what followed.

CoW Swap’s report identified multiple system-level failures that escalated the outcome. A legacy hardcoded gas ceiling rejected better quotes that could have routed the trade efficiently.

Advertisement

The winning solver also failed to execute the trade on-chain as intended. Together, these two failures severely limited the options available for completing the swap.

Further complicating matters, a suspected mempool leak exposed the private transaction to public view. This meant any observer, including automated MEV bots, could see the order before confirmation. The exposure proved costly, as it directly opened the door for a targeted attack.

Because better routes were blocked, the trade was pushed through a SushiSwap AAVE/WETH pool. That pool held only about $73,000 in total liquidity at the time of the swap.

Routing a $50 million order through such a thin market caused extreme price slippage. The user ultimately received a fraction of what the trade should have returned.

MEV Bots and Block Builders Extracted Millions From the Failed Swap

Once the transaction leaked to the public mempool, an MEV bot quickly identified the opportunity. The bot front-ran the trade by buying available AAVE before the user’s order confirmed. This action drove the price of AAVE sharply higher, hurting the user’s final settlement.

Advertisement

The bot then sold its AAVE position immediately after the user’s trade was filled. This sandwich attack netted the bot an estimated $9.9 million in profit. @CoWSwap’s report identified the mempool leak as a central factor enabling this attack on the DeFi user.

To guarantee the correct block sequence, the MEV bot paid Titan Builder directly. The block builder extracted roughly $34 million in ETH for facilitating the arrangement. This coordination between the bot and the builder was key to the attack’s execution.

In response, @CoWSwap has patched its legacy gas limits to prevent similar routing failures. @aave is deploying “Aave Shield,” which will automatically block swaps with a price impact above 25% by default. Both protocols are now working to prevent this type of loss from recurring across DeFi.

Advertisement

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Crypto World

Aave to Roll Out Aave Shield After $50M User Loss Incident

Published

on

Aave to Roll Out Aave Shield After $50M User Loss Incident

Decentralized finance protocol Aave said it is introducing a new feature to block swaps with a price impact above 25% after a user lost $50 million in a trade while interacting with Aave’s interface last week. 

“We are soon deploying a new feature, Aave Shield, which provides more protections for users who use the swap feature in the Aave interface aave.com,” Aave said in a post-mortem statement on Saturday.

Aave said users would need to manually disable the Aave Shield protection feature to proceed with high-risk trades.

The incident occurred on Thursday, when the user went to convert $50.4 million worth of USDt (USDT) for Aave (AAVE) via decentralized exchange CoW Swap, but received only $36,500 worth of Aave due to a lack of liquidity and other infrastructure failures, generating a loss of just over $50 million. 

Advertisement

Part of this loss was also a result of a Maximal Extractable Value (MEV) bot that executed a sandwich attack on the user, profiting nearly $10 million.

User ignored multiple warning signs

Aave said the user signed the transaction despite multiple warnings appearing on the platform’s interface. 

This included alerts about a “high price impact” and a notice stating the route might return less due to low liquidity or small order size. 

The user also ticked a confirmation box stating, “I confirm the swap with a potential 100% value loss,” Aave said. 

Advertisement
What the user would have seen on Aave’s interface before signing the transaction. Source: Aave

Incident shows DeFi still needs work: CoW DAO 

While Aave and CoW DAO, the team behind CoW Swap, said poor liquidity led to the “extreme price impact,” CoW DAO added that multiple infrastructure failures also played a role.

CoW DAO said a solver — a third-party service that finds the best way to do a trade — was affected by an outdated gas limit, which blocked better-priced quotes and left only a much worse option for the user to consider.