Mango Market hacker’s attempt to exploit Aave fails

Mango Market’s exploiter Avraham Eisenberg’s attempt to replicate his “highly profitable trading strategy” on Aave (AAVE) has failed, resulting in the loss of millions.

CRV war was played out on #Aave yesterday and ended with the longer defeating the shorter.

1.🧵

ponzishorter.eth shorted $CRV by borrowing and dumping $CRV;$CRV guardians bought $CRV, soaring the price to $0.72, and liquidating all collateral of ponzishorter.eth.

— Lookonchain (@lookonchain) November 23, 2022

Lookonchain reported that ponzishorter.eth — an address associated with Eisenberg — transferred $40 million USD Coin (USDC) into Aave to borrow Curve (CRV) token with the intention of shorting. This resulted in CRV price tanking 26% to $0.464 from $0.625 over the past week.

However, the move didn’t go entirely as planned as the community rallied behind CRV, buying the DeFi token and causing its value to spike 46% in the last 24 hours to as high as $0.71

First, he came for Mango, and I did not speak out, for I am not an investor

Then he came for USDT, and I did not speak out, for he did not pose a risk

Now, he tries to hunt the loan of one of the godfather’s of DeFi and that’s when the foot is put down to defend pic.twitter.com/feV78YPtq0

— Andrew Kang (@Rewkang) November 22, 2022

Arkham says CRV shorting might be a bait

Blockchain analytics firm Arkham Intelligence tweeted Eisenberg might be baiting people to believe that he was shorting CRV to cause the liquidation of Michael Egorov, founder of the DeFi network.

According to Arkham Intelligence, Eisenberg’s real target was AAVE’s vulnerable looping system and his borrowings could leave the DeFi network with severe bad debt. The blockchain analytics firm added:

“To liquidate Avi’s position, AAVE liquidators will have no way to buy back all the CRV he borrowed. On-chain, there is no liquidity to pay back more than ~20% of the position. AAVE will have to sell significant amounts of tokens from the safety module to cover this loss.”

In October, Eisenberg explained that it was possible to manipulate Aave lending policies to borrow massively, dump it, and leave Aave with bad debt.

Aave issues statement

Following the failure of the short strategy, Aave said the liquidation process of its CRV pool was successful and went as planned. But it noted that the position was not fully covered as 2.6 million CRV ($1.6 million) remained, representing less than 0.1% of the positions on the protocol.

1/6 We want to address the cycle of liquidations that occurred in the CRV pool on the Aave Protocol today. The liquidations were successful (and worked as designed), but unfortunately, the size of the position left some excess debt within the protocol.

— Aave (@AaveAave) November 22, 2022

Gauntlet Network, the financial modeling company managing Aave, said it will cover the loss through its insolvency refund program. The firm added that it has made several proposals in the past few weeks to mitigate these types of attacks.

Just to clarify:
1) Our insolvency refund *will* help cover this (in case that wasn’t clear)
2) We made multiple proposals over the past few weeks to limit these type of attacks

We’ll post a full analysis and post-mortem in the AAVE forums soon https://t.co/LKeeCUx2yd

— Gauntlet (@gauntletnetwork) November 23, 2022

A new governance proposal is now live on Aave that will prevent another price manipulation on the platform.

Meanwhile, the Aave community pointed out that the developers could have done something to prevent this scenario as they had received several warnings about the possibility previously.