Algorithm flaw or misconfiguration? The culprit behind Aave’s $27 million liquidation.

Written by: Cointelegraph

Translated by: AididiaoJP, Foresight News

Summary

• wstETH collateral experienced a brief 2.85% price deviation, triggering approximately $27 million in liquidations on Aave. This event shows that even minor technical issues in automated DeFi lending systems can lead to significant financial impacts.
• The liquidation wave was caused by Aave temporarily valuing wstETH at about 1.19 ETH, while the market value at the time was close to 1.23 ETH, causing some loan positions to be misjudged as undercollateralized.
• Price oracles are critical infrastructure in DeFi, responsible for transmitting external market data to smart contracts to determine collateral value, assess loan health, and trigger automatic liquidations.
• The root cause was not a failure of the price data source itself, but a misconfiguration in Aave’s CAPO risk oracle module. Outdated smart contract parameters set a temporary cap on token exchange rates.

DeFi protocols rely on automated logic to handle everything from collateral management to risk assessment. While this mechanism creates a truly open, permissionless financial system, it also means that minor technical issues can quickly escalate, causing severe financial turmoil.

According to a report by risk monitoring firm Chaos Labs, the market downturn on March 10, 2026, triggered about $27 million in borrower liquidations on Aave, clearly illustrating this vulnerability. Within 24 hours, user positions worth roughly $27 million were liquidated. Surprisingly, this event was not caused by a large market sell-off but by a brief 2.85% price deviation in wrapped staked ETH (wstETH) collateral.

This incident strongly reminds us that the reliability of price oracles and robust risk management frameworks are vital for maintaining the stability of the DeFi ecosystem.

This article explains how a 2.85% pricing deviation in wstETH collateral led to about $27 million in liquidations on Aave. It focuses on how oracle configuration, smart contract parameters, and automatic liquidation mechanisms amplified a minor pricing error in the DeFi market.

Sudden Surge in Liquidations

When a wave of liquidations hit Aave, Chaos Labs, which closely monitors protocol anomalies, quickly identified and reported the situation. Initial market observers speculated that a price oracle malfunction caused the platform’s collateral assets to be mispriced.

Price oracles serve as a crucial bridge, providing external market prices to on-chain applications. In protocols like Aave, these prices directly determine whether a borrower’s collateral is sufficient to cover their loan. If collateral value falls below the required safety threshold, the system automatically liquidates the position.

The core asset involved was wstETH, a token widely used as collateral in DeFi lending ecosystems.

Liquidation speed on protocols like Aave often far exceeds traditional margin calls. Because DeFi markets operate 24/7 via automated smart contracts, once the collateralization ratio drops below the threshold, positions can be liquidated within seconds.

What is wstETH?

wstETH (wrapped staked Ether) is a token issued by the liquidity staking protocol Lido.

When users stake ETH through Lido, they first receive stETH, which represents their staked principal plus accumulated staking rewards. To improve compatibility with various DeFi applications, stETH can be “wrapped” into wstETH.

Due to the continuous accumulation of staking rewards, the value of 1 wstETH is usually slightly higher than 1 ETH. This feature makes it an attractive and widely adopted collateral type in DeFi lending markets.

Pricing Deviation Event

In this liquidation wave, the actual market value of wstETH deviated from the valuation used by Aave’s risk system. Aave’s algorithm valued wstETH at about 1.19 ETH, while the broader market valuation was around 1.23 ETH.

A roughly 2.85% discrepancy made collateralized positions using wstETH appear undercollateralized, even though the actual market value was higher.

As a result, some borrowing positions fell below the safety threshold, triggering Aave’s automatic liquidation process.

Why Are Price Oracles Critical in DeFi?

Price oracles are foundational infrastructure in DeFi. Since blockchains cannot access real-world market data directly, they rely on oracle services to provide external asset prices. These prices directly influence:

• Collateral valuation
• Loan health assessments
• Liquidation triggers

When collateral prices report a sudden decline, protocols may determine that loans are undercollateralized and automatically liquidate the affected positions.

Because this mechanism is fully algorithm-driven, even tiny pricing deviations can cause chain reactions.

In DeFi, small price discrepancies can have outsized effects. Short-term fluctuations in oracle or market prices—just a few percentage points—can trigger cascading liquidations. This risk is especially high when many borrowers use high-leverage positions and collateralize volatile cryptocurrencies.

Root Cause: CAPO Risk Oracle Misconfiguration

Deep investigations confirmed that Aave’s main price oracle was functioning normally.

The actual issue lay in the “Related Asset Price Oracle” (CAPO) risk module, a protective layer added for specific assets.

CAPO’s primary function is to set a rate cap on the appreciation of yield-bearing tokens like wstETH, aiming to prevent sudden price surges or oracle attack risks.

However, in this incident, internal misconfiguration within the CAPO module caused the problem.

Technical Analysis of the Error

Chaos Labs revealed that the issue stemmed from outdated parameters stored in the smart contract.

Two key parameters failed to update synchronously:

• The reference exchange rate
• The timestamp associated with that rate

Because these parameters were not synchronized, the calculated temporary upper limit for the exchange rate was lower than the actual market rate at the time.

This caused the protocol to undervalue wstETH by about 2.85% compared to the market price.

Aave relies on price oracles—sources that provide real-time asset prices to smart contracts. If these data sources temporarily reflect abnormal market prices from exchanges, the protocol recalculates collateral values and may trigger liquidations.

Chain Reaction of Liquidations

Once the collateralization ratio drops below the safety threshold, Aave’s automatic liquidation engine kicks in immediately.

Liquidators (usually high-speed trading bots) quickly intervene by repaying part of the borrower’s debt and obtaining collateral at a preset discount.

In this event, about $27 million worth of borrower positions were liquidated.

Liquidators exploited this brief price mismatch, earning approximately 499 ETH in profit (including liquidation bonuses).

No Bad Debt for the Protocol

Despite the large liquidation volume, Aave itself did not incur any bad debt. Aave founder Stani Kulechov stated, “It did not impact Aave’s core operations.”

Chaos Labs pointed out that once a position breaches the safety threshold, the platform’s core risk controls and liquidation mechanisms operate as designed. Therefore, the impact was limited to the affected borrowers and did not threaten Aave’s overall solvency or stability. The temporary artificial undervaluation of collateral caused some positions to fall below the liquidation threshold.

Aave governance subsequently proposed using recovered funds and DAO treasury to compensate affected users. This approach reflects a new trend in DeFi governance: treating such technical incidents as systemic infrastructure risks and preferring to compensate affected users rather than letting them bear the full loss.

Reaffirming the Risks of DeFi Price Oracles

This incident highlights that oracle mechanism design is both a critical and vulnerable component of DeFi infrastructure.

When automated systems manage hundreds of billions of dollars in collateral, even minor misconfigurations can lead to far-reaching and severe consequences.

Similar incidents have occurred on other DeFi platforms. For example, one platform once misconfigured its oracle, temporarily valuing Coinbase’s wrapped staked ETH (cbETH) at about $1 (actual value around $2,200), causing widespread chaos.

These cases demonstrate that maintaining reliable and accurate price data sources remains a persistent challenge in decentralized finance.

wstETH and Lido Are Not Responsible

Contributors within the Lido ecosystem explicitly stated that the liquidation was not caused by any fault or defect in the wstETH token itself.

The token functioned normally throughout the event, and the underlying Lido staking protocol remained fully operational and unaffected.

The core issue was how Aave’s lending protocol, through its risk management configuration, handled and interpreted the price data, leading to the misjudgment.

Lessons for the Future of DeFi

As decentralized finance continues to evolve, protocols are deploying increasingly sophisticated risk management systems to accommodate assets like yield-bearing wstETH.

Since these assets’ values grow with accumulated staking rewards, they present unique pricing challenges.

Effective risk models must carefully address factors such as:

• Dynamic exchange rates
• Continuous accumulation of staking rewards
• Time-dependent parameter updates
• Precise synchronization of smart contract parameters

Even slight misalignments among these elements can escalate into large-scale liquidations.