Aave Proposes Governance Changes After Failed $60M Short Attack

Exploit failed due to miscalculation of Aave's liquidity levels.

On Nov. 23, a day after Mango Markets exploiter Avraham Eisenberg attempted to use a series of sophisticated short-selling to exploit the Aave decentralized finance protocol, project contributors advanced a series proposals to deal with the consequences. As stated by protocol engineering developer Llama and financial modeling platform Gauntlet, both of which are deployed on Aave:

"Over the past week, user 0x57e04786e231af3343562c062e0d058f25dace9e [Eisenberg-associated wallet] opened a short position in CRV [Curve] using USDC as collateral. At its peak, the user was selling around 92 million units of CRV (approximately $60 million at today's prices). CRV's attempted short sale on Aave failed and the user lost approximately $10 million to liquidations."

Llama wrote that the user was liquidated, but at the cost of $1.6 million in bad debt, likely due to a slippage. "This excess debt is isolated only to the CRV market," the company wrote. "While this is a small amount compared to Aave's total debt, and well within the limits of Aave's security module, it is best to recapitalize the system to make the entire market CRV."

Going forward, Llama's proposal calls on the Gauntlet Insolvency Fund and Treasury Aave to settle bad debt. Another separate proposal advanced by Gauntlet calls for temporarily freezing a list of token markets (including CRV) on Aave V2. The day before, Eisenberg attempted to induce a liquidity crisis on Aave by shorting large amounts of CRV, which was illiquid on the platform, and forcing smart contracts to buy out positions at a loss due to a very high slip (more than 90%) . However, the trade failed when Eisenberg was liquidated with...