Cowrie Research

aave-v2-crv-short-squeeze-liquidation-bad-debt-2022-11-22

15 min read

Aave V2 CRV Short-Squeeze Liquidation / Bad Debt (2022-11-22)

  • Name: Aave V2 CRV short-squeeze liquidation / bad debt
  • Date: 2022-11-22
  • Protocol: Aave V2
  • Chain: Ethereum
  • Category: concentrated-borrow risk / liquidation spiral / stressed-unwind failure / bad-debt incident
  • Loss: roughly $1.6M of bad debt in the CRV market, also described in later analysis as about 2.6M CRV of excess debt; the shorter itself lost roughly $10M
  • Summary: Starting on 2022-11-13, address 0x57e04786e231af3343562c062e0d058f25dace9e deposited about 63.596M USDC on Aave V2 Ethereum and borrowed about 92M CRV, then sold roughly 20.45M CRV on DEXs to push CRV down from about $0.59 to $0.43. The public thesis was to pressure Michael Egorov’s large CRV-backed Aave borrow position into liquidation. That target never broke. Instead, CRV reversed sharply upward on 2022-11-22, the shorter’s own account became liquidatable, and Aave’s liquidation engine had to rely on outside liquidators sourcing CRV into a squeeze. Liquidation technically worked, but not fast enough or deeply enough: 21 liquidators executed 385 liquidations, the position crossed into a toxic unwind regime as CRV kept rising, and Aave finished the event with about $1.6M of bad debt even after the user had been fully liquidated.
  • Trigger / entry point:
    • Aave V2 allowed one account to build an exceptionally large short in CRV against USDC collateral.
    • The user tried to force liquidation of a much larger CRV-backed position elsewhere on Aave by pushing down CRV spot price through open-market sales.
    • Aave V2 lacked later V3-style risk controls such as borrow caps and tighter market isolation, so the protocol’s risk surface depended heavily on whether external liquidators could unwind a huge borrowed-asset short under stress.
  • Root cause:
    • The decisive failure was not a stale oracle, reentrancy bug, or direct contract exploit. Aave priced the position correctly enough to trigger liquidation.
    • The real weakness was liquidation-path capacity. Aave’s fixed-discount liquidation design outsourced short-cover execution to outside liquidators who had to source CRV in the same rising market that was squeezing the borrower.
    • Once the debt size was large relative to available market depth and liquidator balance-sheet capacity, solvency depended on liquidation speed and unwind liquidity rather than on simple collateral-ratio math.
    • In other words, Aave let one borrow-side concentration become large enough that can the market be liquidated cleanly? mattered more than does the account cross the threshold on paper?
  • Exploit path:
    1. Beginning on 2022-11-13, the user 0x57e04786e231af3343562c062e0d058f25dace9e deposited 63.596M USDC into Aave V2 Ethereum and borrowed about 92M CRV.
    2. The user sold about 20.45M CRV on DEXs, pushing CRV from about $0.59 to $0.43 and attempting to pressure the large CRV-collateralized Aave position associated with 0x7a16ff8270133f063aab6c9977183d9e72835428.
    3. Aave governance and Gauntlet were already watching CRV risk. In the 2022-11-11 downturn analysis, Gauntlet highlighted that large CRV supplier’s changing borrow usage and noted that ETH V2 had already seen more than $28.6M of collateral liquidations across the broader crash window.
    4. Around 11:00 UTC on 2022-11-22, CRV price began rising sharply instead of continuing down. The shorter’s own CRV debt moved through liquidation threshold.
    5. Liquidators had to acquire CRV, repay part of the debt, and seize discounted USDC collateral. According to EigenPhi, 21 liquidators executed 385 liquidation transactions.
    6. Because CRV kept rising while liquidations were ongoing, the liquidation process did not cleanly restore solvency. The event crossed the toxic liquidation spiral boundary later described in academic and liquidation-research writeups: each additional liquidation could still be locally profitable for liquidators while leaving the remaining position structurally worse for the protocol.
    7. The shorter was fully liquidated and lost about $10M, but Aave still ended with roughly $1.6M of bad debt in the CRV market, later also described as about 2.6M CRV of excess debt.
  • What the attacker or failing system needed to be true:
    • Aave had to permit a single account to borrow a very large share of the available CRV market against stable collateral.
    • Spot and borrow liquidity had to be deep enough to establish the short, but too shallow to guarantee a clean unwind once CRV reversed upward.
    • Liquidators had to remain optional, profit-seeking external actors rather than a pre-funded protocol backstop obliged to extinguish the whole position immediately.
    • Risk controls on Aave V2 had to leave the protocol exposed to concentrated borrow-side market stress in CRV.
  • Technical anatomy worth remembering:
    • The stress sat on the debt side, not the collateral side. The collateral was USDC, but the hard asset to source during liquidation was the borrowed token, CRV.
    • That makes this incident a useful counterpart to classic collateral-overvaluation exploits. No fake collateral price was needed; a real upward move in the debt asset was enough to break the unwind assumptions.
    • The liquidation engine depended on liquidators being willing and able to keep buying or sourcing CRV as the market moved against the borrower. That creates a reflexive squeeze dynamic very different from a normal sell collateral into weakness story.
    • Partial liquidations and profit-maximizing liquidator behavior are not the same thing as protocol-optimal liquidation speed. When the position is too large, individually rational liquidation clips can still leave the protocol with bad debt.
    • This is a clean example of why liquidation exists is not the same thing as liquidation can restore solvency at this size.
    • It is also the debt-asset-side exemplar for liquidation-capital-provenance-and-keeper-competition-assumptions: Aave’s paper solvency math on the USDC collateral side stayed legible, but the real solvency-restoration bottleneck was outside liquidators sourcing enough rising CRV quickly enough to close the short.
  • Representative accounts:
    • CRV shorter / bad-debt account: 0x57e04786e231af3343562c062e0d058f25dace9e
    • Targeted large CRV supplier: 0x7a16ff8270133f063aab6c9977183d9e72835428
    • Profitable liquidator highlighted by EigenPhi: 0xc37704a457b1ee87eb657cae584a34961e86acac
  • Response / mitigation:
    • On 2022-11-22, Gauntlet posted an ARC recommending temporary freezes for several Aave V2 Ethereum markets, including CRV, explicitly citing V2’s weaker control set relative to V3 such as the lack of borrow caps and isolation-style containment.
    • On 2022-11-23, Llama and Gauntlet posted an ARC proposing to repay the excess CRV debt using Gauntlet’s insolvency refund plus Aave treasury resources rather than immediately slashing the Safety Module.
    • Later Aave governance timelines record AIP-121 executing on 2022-11-27 to freeze CRV on V2 Ethereum, followed by later parameter revisions and partial reversals as the community debated how aggressively to constrain CRV markets and encourage migration toward V3.
    • The durable lesson was not just watch CRV more carefully; it was that concentrated borrow-side exposure on V2 needed stricter caps, better migration pressure, and clearer recapitalization playbooks.

Three liquidation-authority promotions this incident collapsed

  1. A giant CRV short was still treated as ordinary liquidatable inventory rather than as a position that could outrun the unwind rail itself

    • By the time the account held about 92M CRV of debt against 63.596M USDC, the important fact was no longer merely health factor can be monitored.
    • The protocol had already allowed one borrower to become a system-relevant forced buyer of CRV if the market reversed.

  2. The existence of live liquidations was over-promoted into canonical evidence that stressed short-cover price discovery still worked

    • Once CRV rallied on 2022-11-22, Aave correctly crossed the account into liquidation and outside actors did show up: EigenPhi counted 21 liquidators and 385 liquidation transactions.
    • But that fact only proved the liquidation path is callable. It did not prove the stronger claim that the same path could source enough rising CRV quickly enough to restore solvency for a position of this size.

  3. That accepted partial-liquidation path still retained full debt-resolution authority even after the unwind had turned toxic

    • Aave continued to let the standard close-factor / liquidation-bonus machinery define the rescue path while the remaining position worsened under the same squeeze conditions that liquidators were trying to trade through.
    • The result was the decisive failure: many locally rational liquidations still ended with about $1.6M of bad debt, because some profitable clips executed had been mistaken for the protocol still had a solvency-restoring unwind.

The reusable lesson is that a large debt position exists, the liquidation path is firing, and that firing path can still fully extinguish the debt at sane stressed prices are three different claims. Aave had the first two and still partly failed on the third.

Pattern tags

  • Core recurring pattern: liquidation-auction-liveness-failure.
  • The preserved shape is sharper than generic short squeeze or generic bad debt: Aave let one USDC-backed account become a system-relevant forced buyer of CRV, then relied on external liquidators to source that same rising debt asset quickly enough to keep the unwind from going toxic.
  • This is the clean debt-asset-side companion to collateral-side liquidation failures. The collateral was strong and the liquidation trigger was real; the missing safety margin was executable short-cover depth and liquidation throughput under squeeze conditions.

Why the exploit worked

  • Aave V2 allowed one borrower to build a CRV short large enough that liquidation itself became a market event. The protocol’s risk surface was no longer mainly USDC collateral ratio but can outside actors buy back enough CRV before the squeeze outruns the discount?
  • The liquidation path depended on optional, profit-seeking external liquidators rather than a pre-funded protocol backstop committed to extinguishing the whole debt position. That dependency was usually acceptable at ordinary size but became fragile once one account controlled a huge share of CRV debt.
  • The stressed bottleneck was the borrowed asset, not the seized collateral. Liquidators could seize discounted USDC, but only after first sourcing CRV into a rising market where the account itself had already helped create short-cover pressure.
  • Aave’s V2 control set lacked later V3-style containment such as borrow caps and tighter isolation, so governance could react only after the unwind was already live. The freeze and recapitalization proposals were corrective actions, not protections that existed at position-build time.
  • The bad debt therefore came from a joined design failure: oversized debt-side concentration, realistic but too-shallow liquidation throughput, and no earlier control that forced the market back inside executable short-cover limits before the squeeze arrived.

Detection and audit pivots

  • Start with debt-side concentration rather than collateral quality: what share of total CRV debt, and what share of realistic stressed CRV buy-in depth, could one borrower accumulate before liquidation stopped being restorative and became market-moving?
  • Ask what exact asset liquidators must source to save the protocol. In this case the critical input was rising CRV, not a haircut on USDC; if the repay asset is the stressed bottleneck, liquidation bonuses alone are not a sufficient safety story.
  • Simulate liquidation throughput under an adverse debt-asset reversal, not only under a collateral drawdown. A position that looks safe in a collateral down model can still become toxic when the borrowed asset rallies into a crowded short.
  • Audit whether partial liquidations remain protocol-optimal at concentrated size. Individually profitable liquidation clips can still leave the remaining position undercollateralized if each step forces the next rescuer to source the same asset at worse prices.
  • Review legacy-market controls as lifecycle risk. If V2 lacks borrow caps or other containment that V3 already treats as standard, ask why the old market still permits a debt-side concentration envelope the new design would refuse.
  • Check the recapitalization and freeze path before the event, not after it. If the first serious plan for excess debt coverage appears only once the squeeze is already live, the market was relying on governance improvisation rather than a finished stressed-unwind design.

Failure-prevention checklist

  • Size borrow caps and de facto short limits from stressed CRV buy-in depth, not only from USDC collateral quality or ordinary-hour liquidity. A market where one account can become a forced buyer of tens of millions of CRV is already relying on liquidation heroics.
  • Monitor the largest borrower and top correlated cluster as shares of both outstanding CRV debt and realistic short-cover depth, then attach those thresholds to automatic or low-friction de-risking actions such as freezes, cap reductions, or migration pressure.
  • Treat borrowed-asset squeezes as first-class liquidation stress tests. If the risk model mainly asks what if collateral falls? but not what if the debt asset rallies hard into a crowded short?, the protocol is skipping the failure mode that mattered here.
  • If the protocol cannot express debt-asset-specific risk directly in LTV / LT mechanics, compensate elsewhere with borrow caps, isolation, lower overall concentration limits, or outright market freezes. Aave’s own post-incident governance discussion explicitly noted that V2’s collateral-based controls were too blunt for this kind of shorting risk.
  • Keep liquidation-capital provenance explicit. For each market, write down what asset liquidators must source, from which venues, and at what size under stress; a liquidation bonus is not a substitute for real access to rising CRV inventory.
  • Precommit the residual-loss path before the squeeze arrives: treasury recapitalization, insurance / insolvency fund usage, pause rules, and migration plans should be ready before the market discovers that partial liquidations are too slow.
  • Shrink legacy markets once newer control planes exist. If V3 has borrow caps, isolation, and safer containment while V2 does not, leaving the old market open to concentrated debt-side campaigns is itself a governance choice.
  • Review profitable-partial-liquidation dynamics as a protocol-risk surface. The protocol should know when many locally rational liquidations still fail to extinguish the position fast enough to prevent bad debt.

Audit prompts

  • How much of the borrowed asset could independent liquidators realistically source during a fast squeeze, and how much of that amount can one borrower already command indirectly through the debt book?
  • What share of total CRV debt, and what share of executable stressed buy-in depth, did the largest borrower represent before the position became toxic?
  • If LTV and liquidation thresholds are defined by collateral asset rather than borrowed asset, what other controls stop a thin or squeezable debt market from becoming system-relevant risk?
  • At what position size do partial liquidations stop being meaningfully restorative and become only locally profitable clips against a still-deteriorating account?
  • Which venues, lenders, or inventory sources are assumed to supply CRV to liquidators during crisis conditions, and how correlated are those sources with the same squeeze dynamics?
  • Could governance have frozen or capped the market before bad debt crystallized, or was the protocol operationally committed to letting the unwind run once concentration was already visible?
  • If the protocol must socialize residual loss after a debt-asset squeeze, what exact trigger, funding source, and loss-allocation process activate, and were they written down before the event?
  • Why is this market still on the older control surface at all? If a newer deployment has the containment tools that this one lacks, what explicit reason justifies keeping the legacy risk envelope live?

Lessons that should already be standard

  • Strong collateral does not neutralize debt-side concentration. USDC backing did not save Aave once one account became a forced buyer of rising CRV.
  • Liquidation bonuses do not manufacture repay-asset liquidity. A protocol can price a liquidation correctly and still fail because nobody can source enough of the borrowed asset fast enough.
  • Partial liquidation can be individually profitable and still systemically insufficient. 385 liquidations by 21 liquidators proved that liquidation activity exists is weaker than solvency was restored.
  • If risk controls are keyed mostly to the collateral side, debt-side caps and market-level containment become mandatory, not optional. Aave’s own governance posts after the event explicitly pointed to V2’s lack of borrow caps and similar controls as the problem surface.
  • Legacy markets need active shrink paths. Once safer mechanisms exist elsewhere, continuing to host concentrated short-cover risk on the weaker venue is a governance decision, not neutral inertia.
  • Treasury or insurance recapitalization is part of liquidation design whenever unwind depth can fail. The question is whether that loss path is precommitted and bounded, not whether governance can invent one after the fact.
  • The real reviewer question is not only when does health factor drop below 1? but who can still buy back the debt asset at this size once the market moves the wrong way?

Why this incident matters

  • It preserves a bad-debt path that is easy to miss if the corpus only tracks collateral overvaluation and oracle spoofing. Here the borrowed asset itself became the stressed unwind bottleneck.
  • It shows how a protocol can be economically exploited without a bespoke smart-contract bug: the contracts mostly behaved as designed, but the design let one position outgrow the liquidation system’s real-world carrying capacity.
  • It is also a good bridge case between market-manipulation incidents and liquidation-design incidents. The initial short thesis was adversarial and market-shaping, but the lasting protocol loss came from how liquidation interacted with depth, timing, and liquidator incentives under squeeze conditions.
  • It is one of the corpus’s clearest reminders that accurate liquidation trigger and solvency-restoring liquidation path are different claims. Aave had the first and still partly failed on the second.

Internal linkages

Control surface

Graph View

Backlinks