Chaos Labs: The Aave approximately $27 million liquidation event was caused by a configuration issue with the CAPO risk oracle

According to an analysis report released by Chaos Labs, the recent liquidation event of approximately $27 million in Aave was caused by a configuration issue with the CAPO risk oracle.

The root cause lies in the inconsistent update constraints at the smart contract level: the snapshotRatio parameter is limited by an on-chain constraint that allows only a 3% increase every 3 days, preventing it from being updated directly from approximately 1.1572 to the target value of about 1.2282, and it can only increase to about 1.1919; meanwhile, the snapshotTimestamp was successfully updated to a timestamp from 7 days ago. This misalignment between the ratio and the timestamp led to the CAPO calculating an upper exchange rate (approximately 1.1939) that was about 2.85% lower than the actual market exchange rate, triggering the liquidation of approximately 10,938 wstETH. No bad debt was incurred by the protocol during the event.

Chaos Labs and BGD Labs have immediately reduced the wstETH borrowing limit for affected instances to 1 and manually aligned the parameters to restore the exchange rate through Risk Steward. A total of 141.5 ETH has been recovered through BuilderNet, which will be used to compensate affected users, while the remaining amount will be covered by the Aave treasury. The amount expected to be temporarily compensated by the DAO is not anticipated to exceed 345 ETH.