Aave (@aave): Post Mortem on Swap Incident

Post Mortem on Swap Incident On March 12, 2026, a user executed a token swap through the CoW Swap router that is integrated with the Aave interface as a front-end widget. The user attempted to swap 50,432,688 aEthUSDT (worth $50,432,688 USD) for aEthAAVE. The user’s unusually large order in an illiquid market led to a very poor price quote from CoW Swap solvers, which the user affirmatively accepted. The Aave Protocol itself was never at risk as the swap took place outside of the Aave Pprotocol via the third party swap protocol mentioned above. Our immediate response was to begin an investigation, and we are soon deploying a new feature, Aave Shield, which provides more protections for users who use the swap feature in the Aave interface aave.com. This document provides a detailed analysis of the incident. At this time, the concerned user has not contacted us. Background on Aave.com Swaps The swap feature on aave.com is a front-end widget that integrates with CoW Swap, a permissionless decentralized exchange aggregator. This feature allows users to swap tokens using CoW Swap via the Aave interface. The swap feature is a supplementary feature that is separate from the core Aave Protocol smart contracts, which execute the core activities of lending and borrowing. Notably, when a user connects their wallet to aave.com for any reason, the user’s wallet is first screened for suspicious activity and potential financial crimes by two blockchain intelligence firms TRM Labs and Chainalysis, meeting industry AML/CFT standards. Technical Analysis Illiquid Market (Not Slippage) It is critical to distinguish between price impact due to an illiquid market and price impact due to slippage. An illiquid market is one where there is not enough available supply of an asset at a given price to fill a large order without significantly worsening the price. A large order in an illiquid market will have a high price impact. Slippage is the margin the user accepts for a given market price to allow the platform to fill the order as fast as possible, which will usually involve a “surplus” (as defined by CoW Swap) for the value not needed. In this incident, the issue was an illiquid market rather than slippage. The user was quoted a price that was already 99.9% below expected market clearing value for the underlying assets of aEthUSDT and aEthAAVE due to the trade's disproportionately large size relative to available liquidity. The unfavorable outcome was a result of the confirmed quote, not a change in price during execution. Onchain Execution Flow After the user requested a quote from CoW Swap's solvers, which are entities (e.g., algorithmic agents, market makers or human participants) that execute user-defined intents to swap tokens, the solver’s quote of $50.4 million worth of USDT for $36.23 thousand worth of AAVE was presented to the user in the Aave interface. The Aave interface’s swap widget provided a strong warning about proceeding with the quote, stating: “High price impact (99.9%). This route may return less due to low liquidity or small order size.” The user was required to confirm a checkbox next to “I confirm the swap with a potential 100% value loss.” The user affirmatively clicked this checkbox acknowledging the strong warning to proceed with the suboptimal quote. This quote can be viewed in the CoW Swap explorer, where each order has the underlying quote attached. The user then proceeded with the order to swap 50,432,688 aEthUSDT for 322 aEthAAVE. The CoW Swap solver contract at 0x699...d35c8 filled the order, routing through two DEX pools to source the aEthAAVE side of the swap. The user's 50,432,688 aEthUSDT was then sent to CoW Protocol's GPv2Settlement contract. CoW Swap’s solver received these tokens and redeemed them for raw USDT on Aave V3, burning the aEthUSDT and withdrawing 50,432,688 raw USDT. To obtain AAVE tokens, the CoW Swap solver sent these raw USDT tokens into UniswapV3's USDT/WETH pool, receiving 17,957.81 WETH (worth $37,316,623). It then routed the WETH into SushiSwap's AAVE/WETH pool, buying 331.3053 AAVE (worth $36,930). The solver deposited those AAVE tokens into Aave V3, minting 331.3053 aEthAAVE (worth $36,877). CoW Swap settled the user's order by sending 327.2413 aEthAAVE (worth $36,425) to the user's wallet address. The CoW Swap solver kept the remaining 4.064 aEthAAVE (worth $452) as surplus. That surplus was the difference between how much aEthAAVE the routing produced and the minimum required to complete the user's order. The CoW Swap solver completed the final step by returning the 50,432,688 aEthUSDT to the CoW Protocol’s GPv2Settlement contract, which then netted the aEthUSDT against the user's original deposit, closing out its liability and leaving no residual balance. Root Cause Analysis The primary root cause was the routing of a large trade through a market with poor liquidity, leading to an extreme price impact. CoW Swap published their own post mortem with their detailed technical explanation of the routing issue and the quote presented. Above is a screenshot of the primary warning the user would have seen. The swap button was greyed out until the user confirmed that they were okay with the terms of the swap, including the potential for a 100% loss of value. An internal audit trail confirms that the user, who had opted in to cookies while on a mobile device, manually acknowledged the strong warning by clicking this checkbox. Our Response and Next Steps Our core building philosophy is based around the principles of permissionless finance. At our core, Aave Labs builds products that balance the tradeoff between permissionless operations and protecting users from mistakes. Permissionless operations can be critically important in times of market stress. For example, sometimes it’s very important for users to execute swap at any slippage or price impact and when user discretion is critical. However, that doesn’t mean user experience has no safeguards or friction for these types of actions. As a result of the feedback from this incident, we’re implementing a feature in the swap widget called Aave Shield. By default, Aave Shield automatically blocks any swap with a price impact greater than 25%. This creates a high friction guardrail for users, requiring them to have to manually visit the Settings menu and intentionally disable the Aave Shield protection in order to proceed with a high-risk trade. Aave Shield provides yet another layer of protection to prevent accidental confirmations, while maintaining permissionless operations for advanced users. This particular swap also created a $110,368 swap fee (based on a 25 bps fee, verifiable in CoW Swap's metadata) that was collected by the aave.com interface. This is significantly less than the original amount in an early rough estimation published on March 12. Either way, these funds will be held and returned to the user if the user contacts us and goes through a verification process. We will continue to monitor the situation from here and will continue working both internally and with the CoW Swap team, to improve the swapping experience on aave.com in order to provide the best possible experience for our users.