A Bug in Aave V2 on Polygon Has Been Fixed

A routine update of interest rate parameters temporarily blocked over $100 million in various assets in the Polygon version of Aave V2.

Alex Harutunian

May 27, 2023 - 2 min read

Aave, the largest DeFi lending protocol, encountered a bug that caused various assets worth more than $100 million to get stuck within the smart contracts. The problem only affected Aave V2 and not Aave V3.

Aave V2 is an older version of the crypto lending protocol Aave. This protocol version was launched in late 2020, three years after the Aave V1 version. Aave V2 opened up the possibility for users to perform various actions to optimize their positions, as well as to use wrapped Ethereum (wETH).

In January this year, the Aave V3 version of the protocol was successfully launched, which introduced many new features. The Aave team has actively promoted the migration from V2 to V3 since then.

Relative value locked in different versions of Aave protocol as of 26 May 2023. Source: Defillama

Nevertheless, the Aave V2 protocol is still active with $1.5 billion of assets under management, so the regular proposals for changes in the protocol parameters are still accepted and actioned.

The problem occurred after the execution of one such proposal, "Aave V2 Interest Rate Curve Changes", on May 19. Due to differences between the smart contract interfaces deployed on Ethereum and Polygon, the update that was designed for Ethereum did not work properly on Polygon. As a result, over $100 million worth of assets in USDT, wETH, wBTC and wMATIC were blocked.

💡

Aave is designed as a non-upgradable smart contract, hence there are different deployments (version V2, V3) on each update. However, some components of the contract that contain the operational parameters such as lending rates, etc., can be updated. The approval and implementation of such updates are done under decentralized governance.

The block did not affect any of the users' balances and, judging by the few reactions to the community posts, largely passed unnoticed.

On May 24, a week after the bug appeared, Aave users unanimously voted to implement a fix patch that solved the issue. Aave V2 on Polygon is now successfully functioning and we continue to Observe it.