CoW DAO (@CoWSwap): POST MORTEM: AUSDT→ AAAVE Trade Incident (Block 24643151)

POST MORTEM: AUSDT→ AAAVE Trade Incident (Block 24643151) On March 12, 2026, at approximately 18:21 UTC, a collateral swap executed through the Aave v3 front end (powered by CoW Protocol) resulted in a user selling approximately $50M of Aave v3 USDT (aUSDT) for ~324 Aave v3 AAVE (aAAVE) tokens at a significant loss due to extreme price impact. The loss resulted from a chain of compounding factors: a fill-or-kill order on an illiquid pair at extreme size, a quote verification system with a stale gas ceiling that rejected better-priced quotes, a winning solver that subsequently failed to execute the order onchain, and a transaction that may have leaked from a private mempool. Status: The trade is final and irreversible onchain. The user's position has been fully executed. Technical remediation of the identified infrastructure issues is underway, with one fix already deployed. Open investigations into solver execution failures and a possible mempool leak are ongoing. Timeline of Events Phase 1 — Quote Request (18:20:21–18:20:22 UTC) The user initiated a collateral swap via the Aave v3 front end. The UI requested a quote for the underlying assets (USDT → AAVE) to determine the order's limit price, which is a deliberate design decision, as underlying asset pricing is better supported and should closely match aToken valuations. The actual order, however, traded the aToken pair (aUSDT → aAAVE). Additionally, given the user's existing supply and borrow positions, the underlying swap did not pose a liquidation risk, which allowed the order to execute as a simple ERC-20 swap rather than routing through adapter contracts, significantly reducing gas costs and avoiding flashloan fees. Three solvers responded: Solver C's failure warrants specific attention. The quote verification infrastructure enforces a hardcoded 12M gas unit ceiling, legacy code predating current gas consumption patterns for complex multi-hop routes. Solver C's route required more gas than this ceiling, causing the simulation to run out of gas before it could evaluate the route. Independent analysis confirmed the route would have reverted regardless, requiring ~20M gas units (above Ethereum mainnet's per-transaction limit after the Fusaka hardfork). Solver B's failure was a legitimate revert. Result: Solver A's verified quote of ~329.75 AAVE — approximately 150–200x worse than the unverified quotes — was selected. The Aave UI used this value to set the order's limit price at 324.9492 aAAVE. Critical Note: Even the best unverified quotes reflected severe price impact. A $50M fill-or-kill order on this pair cannot be efficiently routed in a single execution; the best quotes implied trading $50M for ~$5–6M of value, a ~90% loss. We are working with Solver A to understand why their pathfinding algorithm discarded liquidity sources that would have yielded a quote closer to the ~$5–6M range. Phase 2 — Order Submission & aToken Quote Competition (18:21:37–18:21:38 UTC) Before the order was submitted, the Aave UI presented the user with multiple explicit warnings about the extreme price impact of this trade. Orders with a price impact exceeding 30% require additional confirmation steps beyond the standard flow, including at least two separate price impact warnings that the user must manually acknowledge before the order can proceed. Given the severity of the price impact on this trade, these safeguards were triggered, and the user confirmed through each step and elected to place the order. The Aave UI submitted a second quote competition (ID: 1110154548) for the actual aToken pair (aUSDT → aAAVE). Three solvers responded, but this competition did not influence the limit price that had already been set by the Phase 1 quote from Solver A on the underlying pair. Critical Note: The order was submitted as fill-or-kill, as is typical for swap orders, requiring complete execution in a single batch. Phase 3 — Solver Auction (Auctions 12479347, 12479350, 12479353) The order entered CoW Protocol's auction system and was proposed for execution across three consecutive auctions. Two solvers competed: Solver E found a favorable execution route and won auctions 12479347 and 12479350. However, Solver E failed to land either winning solution onchain. No onchain reverts were observed for these attempts, meaning the transactions were never submitted. After two failed attempts at execution, Solver E stopped bidding on the order entirely. Solver B, who had produced a strong quote in Phase 1 (~52,417 AAVE), submitted progressively worse bids across all three auctions. In auction 12479353, the only auction where Solver E did not compete, Solver B's bid won by default and was executed onchain. Critical Note: This sequence represents a compounding failure; the solver with the better route won twice but couldn't deliver, then abandoned the order, leaving the worst execution as the only remaining option. Phase 4 — OnChain Execution (Block 24643151) Solver B's transaction landed in block 24643151, built by Titan. The trade executed at the unfavorable price established by the degraded bid. Immediately following the transaction, significant backrun activity occurred within the same block, with arbitrageurs recovering most of the value lost by the user. The top five addresses by ETH gained in this block: The majority of value in this block was captured through backrunning attributable to this specific trade. Mempool leak [currently under investigation]: Although the solver submitted the transaction via a private RPC mempool, evidence suggests the transaction leaked to the public mempool. Etherscan displays a "confirmed within 30 seconds" tag on the transaction, a marker that only appears when Etherscan has observed the transaction in the public mempool prior to block inclusion. Transactions submitted exclusively via private mempools do not carry this tag. Analysis We believe in permissionless DeFi. We also believe that "technically correct" is not the ceiling we should be building toward. A warning checkbox, however clearly displayed, is a blunt instrument when the stakes reach $50M. The gap between what a user intends and what they confirm can be enormous, especially on mobile, under time pressure, or through a failure to grasp what a 99% price impact means in concrete dollar terms. That gap is where this user's funds were lost. At the same time, there are legitimate scenarios such as rug pulls, depegs, and cascading liquidations where accepting extreme price impact might be a rational choice for a user, because the alternative is losing everything. A protocol that blocks those actions is no longer permissionless; it is making decisions on behalf of its users that, while well-intentioned, could cause severe harm in scenarios where execution matters more than price. The challenge is not simply adding more restrictions, it is designing friction that protects users from mistakes without preventing them from acting in genuine emergencies. This is not a problem unique to CoW Protocol or to Aave. It is a structural challenge for DeFi UX at large. We believe we can build something better. What Went Right Before detailing what went wrong, it is important to acknowledge the safeguards that functioned as designed: The Aave UI correctly identified the extreme price impact and triggered its high-impact confirmation flow, requiring the user to manually acknowledge the risk before the order could proceed. The quote verification system correctly rejected routes that would have reverted onchain, preventing wasted gas on impossible executions. The batch auction system ran three consecutive attempts to find the best execution for the order. Solver E identified a favorable route and won two of three auctions, so the competition mechanism worked; the execution delivery did not. What We're Addressing We are in active conversation internally and in partnership with Aave about what stronger, more friction-ful guardrails should look like for orders of exceptional size and price impact, without compromising permissionless execution for users who understand the risks they are taking. Some of the questions we are working through together: At what threshold should price impact trigger a mandatory cooling-off period or secondary confirmation flow? Should orders above a certain size or impact level receive a fundamentally different UX treatment, a limit order prompt, a split-order suggestion, or a hard pause? How do we design for the reality that warnings lose their effectiveness when users have been conditioned to click through them? In parallel, we are addressing the technical issues surfaced by this incident: Areas for Further Examination Effectiveness of confirmation-based guardrails: Price impact warnings fired correctly and required manual confirmation. The user proceeded. The question is whether confirmation dialogs alone are adequate at this magnitude of potential loss. Quote-to-order token mismatch: The Aave UI quoted on the underlying pair (USDT → AAVE) but submitted the order on the aToken pair (aUSDT → aAAVE). In this case, the mismatch benefited the user, as the underlying pair has deeper liquidity and produced a more competitive limit price. Fill-or-kill at extreme size: A $50M fill-or-kill order on an illiquid pair left no room for partial fills or time-weighted execution. Even the best available quotes reflected ~90% value loss. Silent solver execution failures: Solver E won two consecutive auctions but failed to land either solution onchain with no observable reverts. The auction system has no mechanism to detect or escalate this pattern. Possible mempool leak: Evidence suggests the winning solver's transaction was visible in the public mempool despite being submitted via a private RPC, likely enabling the significant backrun activity observed in the execution block without the solver or RPC recapturing most of the value. [Investigation ongoing.] Stale gas ceiling in quote verification: A hardcoded 12M gas unit limit in the simulation infrastructure caused better-priced quotes to fail verification. While these specific routes would have reverted regardless, the ceiling was outdated and could silently reject legitimate quotes on complex routes (this has already been fixed). Next Steps This incident is a reminder that the best possible outcome is not just a technical specification, it is a responsibility. We take that seriously. We will publish updates addressing the open investigations listed above, including final findings on solver execution failures, the mempool leak analysis, and any additional remediation measures. We do not have final answers on all of the issues surfaced above yet. But we are committed to working through them transparently, with Aave and with the broader community. CoW Protocol — March 14th, 2026