Macauley Peterson

<div id="highlights-block_617c70b6ee3ac" class="highlights">
        <ul>
                <li>Aave community members have been concerned about the safety of the protocol following the Cream Finance exploit earlier this week</li>
                <li>Lending rates on USDT spiked as high as 78% APY following the withdrawal</li>
            </ul>
    
</div>



<p>Concerns over the recent <a href="https://cms.blockworks.co/flash-loan-exploit-whips-cream-finance-for-130-million/" target="_blank" rel="noreferrer noopener">Cream Finance exploit</a> that drained $130 million dollars from the protocol have spilled over to the number one blue-chip in DeFi, Aave. On Friday, a significant percentage of the assets deposited into Aave’s V2 money market protocol were withdrawn.&nbsp;</p>



<p>Ethereum <a href="https://twitter.com/FrankResearcher/status/1454113698214289415?s=20" target="_blank" rel="noreferrer noopener">transaction logs</a> indicate the wallets responsible are associated with Justin Sun, the founder of the Tron network, who removed billions of dollars worth of ETH, WBTC, USDC, USDT and TUSD. Collectively these funds represented about 18% of the protocol’s Total Value Locked (TVL), which now stands at $15.2 billion according to <a href="https://defillama.com/" target="_blank" rel="noreferrer noopener">DefiLlama</a>. As a result, Aave has fallen to number three in the TVL rankings behind Curve Finance and MakerDAO.</p>



<p>Justin Sun did not immediately return Blockworks&#8217; request for comment, but discussion of the sudden withdrawal has been rampant on the Aave Discord chat group, where members of the community voiced concerns over the safety of the protocol in the wake of the Cream Finance exploit.</p>



<div class="wp-block-image"><figure class="aligncenter size-full"><img loading="lazy" decoding="async" width="512" height="206" src="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg" alt="" class="wp-image-10127" srcset="https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg?w=512 512w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg?w=300 300w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg?w=428 428w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg?w=470 470w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg?w=389 389w, https://blockworks-co.imgix.net/wp-content/uploads/2021/10/unnamed-12.jpg?w=80 80w" sizes="auto, (max-width: 512px) 100vw, 512px" /></figure></div>



<p>According to Aave’s official Twitter feed, the concern stems from the use of xSUSHI (representing staked Sushi governance tokens) as collateral in Aave, which may be subject to a similar price manipulation exploit that befell Cream Finance. According to Gauntlet Network, a major holder of DeFi governance tokens including AAVE, the potential vulnerability cannot be profitably exploited, which should come as some relief to concerned depositors.</p>



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"><p lang="en" dir="ltr">3/7 The <a href="https://twitter.com/gauntletnetwork?ref_src=twsrc%5Etfw">@gauntletnetwork</a> team ran multiple simulations which showed that any attempt to manipulate <a href="https://twitter.com/search?q=%24xSUSHI&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$xSUSHI</a> on the Aave Protocol would result in losses for the attackers under the current market conditions.</p>&mdash; Aave (@AaveAave) <a href="https://twitter.com/AaveAave/status/1454119663252692992?ref_src=twsrc%5Etfw">October 29, 2021</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<p>In an effort to address the community concerns, Gauntlet <a href="https://twitter.com/AaveAave/status/1454119664678842369" target="_blank" rel="noreferrer noopener">put forward</a> an <a href="https://app.aave.com/#/governance/44-QmNVWrrm3ieyRRVD4f77zdxrvSUj1W4HDCojLKNcxmVQhr" target="_blank" rel="noreferrer noopener">Aave governance proposal</a>, “to disable borrowing of $xSUSHI, $DPI, and the LP tokens on the AMM market to mitigate the potential of any future risks.”</p>



<p>The proposal passed a governance vote with virtually unanimous support and as of Monday morning is &#8220;queued&#8221; for execution.</p>



<p>If, as Gauntlet’s research indicates, the risk of an exploit is small, the question remains: Why did Justin Sun remove his copious assets?</p>



<p>In the wake of the withdrawal, stablecoins — particularly USDT — were in short supply, and both utilization rates and, consequently, the yields being charged borrowers skyrocketed. For several hours, the cost <a href="https://app.aave.com/#/borrow" target="_blank" rel="noreferrer noopener">to borrow</a> USDT on Aave’s V2 Ethereum market was between 60-80% annualized.</p>



<p>Over the weekend, borrowing rates normalized, and as of 5:30 am ET on Monday, rates had fallen to between 4-10% on stablecoins, with the exception of Gemini&#8217;s GUSD, which remained in short supply.</p>



<p>Aave&#8217;s TVL is down nearly 30% over the past seven days to $13.54 billion, <a href="https://defillama.com/" target="_blank" rel="noreferrer noopener">according to DefiLlama</a>, below that of Convex Finance for the first time in its history.</p>



<p><em>This story was updated on November 1, 2021, at 5:40 am ET.</em></p>


Justin Su

Newsletter

Blockworks Research