An Aave oracle malfunction resulted in the improper liquidation of approximately $26 million worth of wstETH.

According to a post-incident report released by Aave's risk management service provider, Chaos Labs, a temporary oracle failure occurred in the Aave protocol on March 10, resulting in the liquidation of approximately $26 million worth of wstETH positions. The incident affected the Aave Ethereum Core and Prime markets, impacting 34 accounts and resulting in the liquidation of approximately 10,938 wstETH. The failure stemmed from a configuration error in Aave's associated asset price oracle, CAPO. A mismatch occurred between the snapshot ratio and the snapshot timestamp parameters in this system, causing the oracle to report an exchange rate of approximately 1.1939, while the actual market exchange rate was approximately 1.228, a discrepancy of 2.85%, triggering automatic liquidation in the E-Mode market. Chaos Labs stated that off-chain processes determined the snapshot ratio should be updated to approximately 1.2282, but on-chain rules limited this parameter to a maximum increase of 3% every 3 days, preventing a one-time update and thus causing the parameter mismatch. In this incident, the third-party liquidator profited approximately 499 ETH from the forced liquidation. The protocol itself did not incur bad debts, and the loss was borne by the borrower. Chaos Labs has temporarily lowered the wstETH borrowing limit and manually aligned the parameters. It is currently implementing a compensation plan, having already recovered 141.5 ETH for compensation. If necessary, up to 345 ETH will be added from the Aave DAO vault. Chaos Labs states that this incident was not a design flaw in CAPO, but rather a misalignment in on-chain configuration under different update constraints.