A Stale Timestamp Inside Aave's Own Safety Oracle Triggered $27.78M in Liquidations

Aave's own defensive infrastructure, not an attacker, wiped out $27.78 million in healthy user positions on March 10. The system responsible, the CAPO oracle, exists specifically to stop price manipulation. Instead, a configuration mismatch inside it caused Aave's liquidation engine to act on a price that was already wrong.

01What happened, in sequence

On March 10, Chaos Labs' off-chain Edge Risk engine pushed a parameter update to the wstETH CAPO oracle. The submission transaction is recorded on-chain: 0xfbafeaa8c58dd6d79f88cdf5604bd25760964bc8fc0e834fe381bb1d96d3db95.

One block later, AgentHub, BGD Labs' automated execution layer, carried out the update on-chain via Chainlink Automation: 0x32c64151469cf2202cbc9581139c6de7b34dae2012eba9daf49311265dfe5a1e. There was no manual review step and no human in the loop — a single block separated computation from execution.

The result: CAPO quietly capped the wstETH exchange rate 2.85% below the actual market rate. Aave's liquidation engine then treated that capped figure as truth. Across 34 accounts, 10,938 wstETH — worth $27.78 million — was liquidated before most affected users noticed anything was wrong. (For reference, wstETH is Lido's wrapped, yield-bearing staked ETH, which trades at a premium to plain ETH; that premium is part of what the $27.78 million figure reflects.)

Notably, this was the Risk Oracle's first incident after streaming more than 1,200 payloads across 3,000-plus parameters without issue.

LTV Protocol was first to flag the discrepancy publicly, posting on X before Aave's own post-mortem was published. Their finding: Aave's oracle was pricing wstETH at roughly 1.19 ETH, while the actual market ratio sat near 1.228849. A gap under 3% doesn't sound dramatic, but it was enough to push 34 leveraged E-Mode positions below their liquidation thresholds.

Chaos Labs' response was fast: the wstETH borrow cap on both Aave Core and Aave Prime was cut to 1, recorded in transaction 0x34f568b28dbcaf6a8272038ea441cbc864c8608fe044c590f9f03d0dac9cf7f8. Aave's official post-mortem followed a few hours after LTV Protocol's post, concluding this was not an exploit but a configuration mismatch between two parameters meant to move in lockstep.

02How two correct steps produced an incorrect ceiling

CAPO — the Correlated Asset Price Oracle — sits on top of the underlying Chainlink feed as an added protective layer; Chainlink's own feed functioned correctly throughout the entire incident. CAPO's specific job is to limit how quickly the wstETH/stETH exchange rate is allowed to rise, so that nobody can artificially inflate collateral value to drain the protocol. It does this with three coordinated parameters: a snapshotRatio (the anchor exchange rate), a snapshotTimestamp (when that anchor was recorded), and a maxYearlyRatioGrowthPercent (how fast the rate may climb from the anchor). If the three drift out of alignment, the ceiling CAPO computes stops reflecting reality.

That's effectively what happened. The wstETH CAPO contracts were initialized in early 2024 with a snapshotRatio of roughly 1.15. On March 10, Chaos Labs' oracle correctly computed an updated snapshotRatio of approximately 1.2282, matching the exchange rate from seven days earlier, and set the snapshotTimestamp to that same seven-day-old reference point exactly as designed. Both the inputs and the logic were correct.

But the smart contract itself rejected the jump. A built-in rate limiter — meant to stop a compromised operator from spiking the ratio maliciously — restricts any single update to 3% within a 3-day window. Since the existing on-chain ratio was near 1.1572, jumping straight to 1.2282 would have exceeded that cap, so the contract only permitted an increase to roughly 1.1919. The oracle checked the ceiling and correctly submitted 1.1919 — the intended fallback behavior, and normally exactly what you'd want.

The problem is that the timestamp wasn't subject to that same throttling. It was still set to the seven-day-old reference point that matched the original, un-throttled 1.2282 calculation. So CAPO ended up holding a ratio of ~1.1919 paired with a timestamp implying that ratio was seven days old — telling the system to extrapolate forward from a starting point the ratio had never actually reached. Extrapolating from that artificially low anchor produced a ceiling of roughly 1.1939, which sat below the live market rate of approximately 1.2285 — and below the rate Aave was already using internally. In effect, Aave began pricing wstETH about 2.85% under its real value.

That 2.85% deviation, trivial for an ordinary position, was decisive for leveraged ones. E-Mode lets users borrow at higher loan-to-value ratios against correlated assets — here, wstETH as collateral against WETH — and higher leverage means a smaller price move is needed to trigger liquidation. Positions that carried essentially no real economic risk were nonetheless sitting right at the liquidation line once the artificial price kicked in, and liquidators swept through all 34 accounts and 10,938 wstETH in short order. The complete liquidation list is viewable on the Chaos Labs liquidation dashboard by filtering for wstETH collateral against WETH debt starting March 10.

Notably, this wasn't the first time this exact scenario had come close to happening. Reporting from YAM indicates a similar ratio/timestamp mismatch was computed and submitted roughly a month earlier, but at that point the CAPO wstETH agent hadn't yet been connected to execute updates, so nothing fired. No alarm was raised and no review followed — the same underlying flaw simply sat dormant until the agent went live and executed it for real.

03Where the money went

Total liquidator profit came to approximately 512 ETH, split three ways. About 116 ETH came from standard liquidation bonuses, divided between third-party liquidators and the Aave Liquidation Protocol — the system behaving as intended, just off a false trigger. Roughly 13 ETH came from liquidation fees. The remaining ~382 ETH came from straightforward arbitrage: liquidators bought wstETH from Aave at the artificially depressed rate of ~1.1939 while the open market still valued it near ~1.2285, then captured the spread. No exploit or manipulation was involved — just a price gap and speed.

04Reimbursement and the accountability fight

Aave has moved to reverse the loss where possible. 141.60 ETH was recovered from Titan Builder, and another 13.32 ETH came back through recovered liquidation fees, for a combined ~154.92 ETH clawed back before the DAO treasury had to cover anything.

On March 11, TokenLogic filed a Direct-to-AIP proposal putting the total refund at 512.19 ETH, with a net cost to the DAO of 357.56 ETH after the recoveries above, while further recovery efforts against the builders involved continue. The proposal stated plainly: "The affected users bear no responsibility for these liquidations, which were the direct result of a protocol-level configuration error. Making these users whole is a straightforward decision for the DAO and reinforces the trust that underpins Aave's position as the leading lending protocol."

Within hours of that filing, delegate ApuMallku raised a formal objection: reimburse users right away, but also require the service provider responsible to repay the treasury. The post argued that automatically absorbing costs whenever a well-compensated provider makes a configuration error creates moral hazard: "Skin in the game cannot just be a buzzword used during budget approvals; it must be enforced when operational oversights cost the protocol money. Let's pay the users, but let's also hold our vendors accountable." That question — who ultimately bears the cost beyond the affected users — remains open in governance.

Separately, wstETH trading volume in the 24 hours around the incident totaled only about $10 million, suggesting no outside party meaningfully exploited the mispricing in the broader market before it was corrected — the damage was largely confined to Aave's own liquidation engine. No bad debt resulted, and the protocol itself remained solvent.

05How the incident was framed publicly

Omer Goldberg, founder of Chaos Labs, addressed the incident directly on X: "Today, a misconfiguration on Aave's CAPO oracle caused wstETH E-Mode liquidations, resulting in a loss of 345 ETH. No bad debt was incurred, and all affected users will be fully reimbursed." Aave founder Stani Kulechov's statement read: "A technical misconfiguration resulted in the liquidation of positions that were already close to their liquidation thresholds. There was no impact to the Aave Protocol." A Lido contributor told CoinDesk: "We are aware of the liquidations due to an incorrect wstETH to USD price reported by this oracle mechanism. The cause has nothing to do with wstETH itself, how it works or the Lido protocol which continue to operate normally."

Chaos Labs' statement owned the technical failure and committed to compensation; Kulechov's framing, by noting the positions were already close to their thresholds, drew some pushback from the community for appearing to shift a portion of the responsibility onto users.

06Context: two departures the week before

The liquidation event didn't occur in isolation. Seven days earlier, Marc Zeller published the letter ending the Aave Chan Initiative's three-year involvement in Aave governance. ACI had reportedly driven 61% of all governance actions, revenue strategies responsible for 48% of protocol income, and GHO's expansion from $35 million to $527 million. Zeller's letter described ACI's years spent establishing standards of transparent reporting, on-chain verification, and service-provider accountability — and said that when those standards were applied to BGD Labs, the team requesting the largest budget in the DAO's history, the process broke down. The Temp Check vote in question passed 622,300 to 497,100, decided by Aave Labs-linked addresses voting on their own proposal — a margin Zeller's post-vote analysis said would have flipped without those votes. His letter stated: "There is no role for an independent service provider in an environment where the largest budget recipient holds undisclosed voting power and uses it on its own proposals."

BGD Labs, the other party in that dispute, had announced its own departure on February 20. The team that built and maintains the V3 codebase — generating more than $100 million annually — said it would not renew its engagement once it concluded on April 1, citing an organizational imbalance created by Aave Labs' control over brand, communications, and voting power: "We stop contributing because the environment no longer aligns with how we operate and where we see our value."

Days later, the CAPO misconfiguration liquidated $27.78 million. Reaction on X was swift; Carnation's post captured the sentiment: "Bad oracle update on Aave as soon as BGD Labs and Zeller decide to leave. Coincidence?" There is no evidence tying the two governance exits to the technical failure — the pipeline that misfired was automated, the error was a configuration issue, and Chaos Labs (which remained active throughout) published its post-mortem the same day. Still, the timing made the incident harder to separate from the broader governance turmoil in the public conversation.

07Part of a broader pattern

This is the third recent DeFi incident traced back to a safety mechanism rather than an attacker. In February 2026, Moonwell briefly mispriced Coinbase Wrapped ETH at around $1.12 instead of roughly $2,200, a configuration-level oracle error that left the protocol with close to $1.78 million in bad debt. That same month, attackers took $10 million from YieldBlox's community-managed pool on Blend by manipulating a VWAP oracle drawing from a market with under $1 in hourly volume; the Reflector oracle itself reported accurately, but the adapter passed the price through without a sanity check and the protocol accepted the resulting valuation unquestioned.

Aave's incident fits the same shape: not a hack, but a safeguard — the CAPO wstETH parameters, set in February 2024 and never reconciled with two years of market movement — that had simply drifted out of alignment with reality. Three protocols, three different technical failure modes, one common thread: each system performed exactly as coded, and each was undone by a gap between its design assumptions and current conditions. Audits confirm code matches its specification at a point in time; they don't confirm that specification still matches reality years later.

08Bottom line

No exploit code, no compromised keys, and no bridge vulnerability were involved. Two parameters inside Aave's own anti-manipulation oracle fell out of sync, an automated pipeline carried the update through without a pause for human review, and 34 accounts holding 10,938 wstETH — $27.78 million — were liquidated as a result. Chaos Labs' own renewal proposal to the Aave DAO calls the Edge Risk Oracle its "top priority," a system that "currently secures over $5B in deposits," and its website markets the same infrastructure as delivering "real-time anomaly detection and circuit breakers to protect protocols from oracle exploits." The Aave DAO treasury is now the body being asked to cover losses caused by that same system — with a near-identical near-miss having gone unnoticed roughly a month before this one actually executed.

Classification note: No external attacker took these funds. This was a protocol-level configuration failure that triggered legitimate liquidations of otherwise healthy positions — users lost money because a system malfunctioned, not because it was breached.