U.Today - Security researchers found a bug in the design of Aave v2's latest release for the Polygon (MATIC) blockchain. It seems that a nine-digit sum in U.S. Dollar Tether (USDT), Wrapped Bitcoin (WBTC), Wrapped Ethereum (WETH) and Wrapped Matic (WMATIC) cannot be operated by their owners.
$120 million worth of assets stuck in Aave v2 on Polygon, here's how
According to an published by smart contract auditors and on-chain researchers at BlockSec, a design flaw was disclosed in the Polygon-based version of Aave v2, a blue-chip DeFi protocol.Researchers stated that the issues were associated with the updated ReserveInterestRateStrategy, which is an element of the protocol's logic in Aave v2.
The most recent version of this logic is only applicable to Ethereum (ETH), but not to Polygon (MATIC).
Pseudonymous Ethereum (ETH) developer who goes by @mookim_eth on Twitter shared a detailed of the roots and effects of the issues highlighted by BlockSec. According to him, Aave v2's lending pool expects a different interface and cannot interact with the updated strategy.
As a result, users temporarily cannot withdraw or exchange 5.5 million USDT, 35,000 Wrapped Ethers (WETH), 1,500 Wrapped Bitcoins (WBTC) and 11 million Wrapped Matic (WMATIC), which is roughly equal to $120 million.
Community creates emergency fix proposal
Despite the fact that the Aave team did not confirm the issue via its official communication channels, the community of the protocol has already released a statement regarding the issue.This confirmed that the assets are unavailable due to a conflict between the Ethereum- and Polygon- based versions of Aave v2 designs:
At the same time, all assets are safe in the protocol and there are no risks of losing any of them. Other assets on Aave v2, including USD Coin (USDC), Dai (DAI) and Aave (AAVE) are working as intended.
On May 20, 2023, community voting on implementing a fix to the Aave v2 codebase will start at about 4 p.m. UTC, the of Aave Governance goes.