Millions of Bitcoin and Ethereum are stuck due to a bug in a DeFi project

Slightly disturbing news about Aave (AAVE), a proxy protocol for decentralized finance (DeFi). BlockSec, Inc Smart contracts examinations, Reports an error In an old version of Aave it linked assets such as wrapped ether (WETH), tether (USDT), wrapped bitcoin (WBTC), and wrapped matic (WMATIC). Users are currently unable to withdraw these tokens. In total, the tokens captured represent a value of $110 million.

Aave v2 Polygon protocol

BlockSec reports that it is particularly relevant to the tokens in the Aave v2 Polygon liquidity pool. BlockSec found that some of the code works with Ethereum (ETH), but not with Polygon (MATIC). Other versions, such as Aave v3 Polygon or Ethereum and Avalanche (AVAX) v2 implementations, are still working. The issues were caused by a patch released on May 16 that failed to account for minor code differences in Polygon.

.@employee The latest ReserveInterestRateStrategy upgrade in Aave V2 (Polygon) has caused the protocol to pause, affecting $110 million in assets!
The underlying reason is that the new ReserveInterestRateStrategy is only compatible with Ethereum, not Polygon. https://t.co/kg5696QNPo pic.twitter.com/Ze3zSBS8Ck

BlockSecTeam May 19, 2023

Did the victims lose millions?

Although it is currently impossible to withdraw tokens, hThe team behind the DeFi project said that the victims’ funds are “completely safe.” Issues can be resolved through a round of voting. Voting will take place between May 20 and May 23. The proposal seeks approval from the Aave DAO, the project’s governing body, to implement the code changes.

The community is expected to approve the proposal. With that, a patch will be introduced that will fix the issues, so that victims can get their tokens back. The incident highlights a frequently cited issue against DeFi protocols by critics. These types of projects are still prone to errors and this can quickly lead to a loss of money. In the case of Aave, it seems to be fading away.