$120 Million Issue Found in Aave (AAVE) New Release

Security researchers found a bug in the design of Aave v2’s latest release for the Polygon (MATIC) blockchain. It seems that a nine-digit sum in U.S. Dollar Tether (USDT), Wrapped Bitcoin (WBTC), Wrapped Ethereum (WETH) and Wrapped Matic (WMATIC) cannot be operated by their owners.

$120 million worth of assets stuck in Aave v2 on Polygon, here’s how

According to an analysis published by smart contract auditors and on-chain researchers at BlockSec, a design flaw was disclosed in the Polygon-based version of Aave v2, a blue-chip DeFi protocol.

.@AaveAave the latest upgrade of ReserveInterestRateStrategy in Aave V2 (Polygon) has caused a temporary halt of the protocol, impacting assets worth ~$110M!
The root cause is the new ReserveInterestRateStrategy is only compatible with Ethereum, not compatible with Polygon. https://t.co/kg5696QNPo pic.twitter.com/Ze3zSBS8Ck

— BlockSec (@BlockSecTeam) May 19, 2023

Researchers stated that the issues were associated with the updated ReserveInterestRateStrategy, which is an element of the protocol’s logic in Aave v2.

The most recent version of this logic is only applicable to Ethereum (ETH), but not to Polygon (MATIC).

Pseudonymous Ethereum (ETH) developer who goes by @mookim_eth on Twitter shared a detailed analysis of the roots and effects of the issues highlighted by BlockSec. According to him, Aave v2’s lending pool expects a different interface and cannot interact with the updated strategy.

As a result, users temporarily cannot withdraw or exchange 5.5 million USDT, 35,000 Wrapped Ethers (WETH), 1,500 Wrapped Bitcoins (WBTC) and 11 million Wrapped Matic (WMATIC), which is roughly equal to $120 million.

Community creates emergency fix proposal

Despite the fact that the Aave team did not confirm the issue via its official communication channels, the community of the protocol has already released a statement regarding the issue.

This statement confirmed that the assets are unavailable due to a conflict between the Ethereum- and Polygon- based versions of Aave v2 designs:

The root of the problem is that, for legacy reasons, the v2 version used on Aave v2 Polygon (and Avalanche) is slightly different from Aave v2 Ethereum, in regards to the interface used by the LendingPool to call the rate strategy of an asset. The new interest rate strategies applied to those assets respect the interface of Aave v2 Ethereum, but not v2 Polygon, so when the LendingPool queries the strategy for the current rate, this call reverts, and so does the action «wrapping» it (e.g. deposit, borrow, etc).

At the same time, all assets are safe in the protocol and there are no risks of losing any of them. Other assets on Aave v2, including USD Coin (USDC), Dai (DAI) and Aave (AAVE) are working as intended.

On May 20, 2023, community voting on implementing a fix to the Aave v2 codebase will start at about 4 p.m. UTC, the proposal of Aave Governance goes.

Source