Ignored slippage messages, lost $50m in just one "approve"

[rat03gopoh]

In short, a trader lost more than $50m after trading aEthUSDT to aEthAAVE on a DEX via mobile. Well, you heard that right, $50m in mobile wallets. The trader actually received warnings about high slippage costs that were ignored. I don't know if he realized he had entered that amount manually or just clicked "max".

The swap process (backend) is a bit complicated with such a large amount: https://etherscan.io/address/0x98b9d979c33dd7284c854909bcc09b51fbf97ac8#tokentxns

• aEthUSDT to USDT: The solver burned 50.43M aEthUSDT via Aave V3, withdrawing 50.43M USDT.
• USDT to WETH via Uniswap V3: 50.43M USDT went into the Uniswap V3 USDT/WETH pool and came out as 17,958 WETH. At $2,050/ETH, $50.4M should yield roughly 24,600 WETH. That's roughly $13.6 million lost to slippage at the Uniswap step alone.
• WETH to AAVE via SushiSwap: Here's where it gets catastrophic. The SushiSwap AAVE/WETH pool currently has only about $73,000 in total liquidity. The solver pushed 17,958 WETH through this tiny pool and got back only 331 AAVE, worth $36,400. That's effectively 99.9% slippage.
• AAVE to aEthAAVE via Aave deposit: 331 AAVE was deposited back into Aave V3, minting 327 aEthAAVE, which was delivered to the trader.

https://thedefiant.io/news/defi/whale-swaps-usd50-million-in-stablecoins-for-just-usd36-000-of-aave

perhaps this is why the slippage warning does not represent the information accurately.

[TastyChillySauce00]

This is the weakness of current swap router contract, their routing is so confusing and there is no way to determine the real output we gonna get and instead we're only getting minOut or max slippage as a guardrail.

There are simply tons of ways we can lose our money using these dex from malicious delegation, unlimited approval, fake token, low liquidity, to getting front ran by a freaking mev bots .

[asriloni]

This is why i believe DEFI is still immature. There is still so many loopholes that make the executors lost their money. It gets worsen with how the money is not refundable, and aave is only giving back 600k fees to the swapper. So i guess defi is not yet ready for the mass adoption.

This tech has so many loopholes and it never gets solved. No doubt that many doubting about defi's capability to handle mass adoption once they can't even solve this mev garbage problems.

There should be a function that prevent this kind of thing to happen. At least, when the liq is not able to fulfill requested amount to swap. It should be cancelded.

[Yamane_Keto]

This is one of the problems with "decentralized" services: the expected trade price cannot be predicted during periods of high market volatility or low liquidity. even if the pool's liquidity increases, it is difficult for small services to handle sums like $50 million, which might be better handled through centralized services. It is also difficult to ensure that $50 million is always readily available as liquidity.

The fault lies entirely with the user.

This is why i believe DEFI is still immature. There is still so many loopholes that make the executors lost their money. It gets worsen with how the money is not refundable, and aave is only giving back 600k fees to the swapper. So i guess defi is not yet ready for the mass adoption.

It is not a technical problem, but it is impossible to continue providing liquidity and imposing low trading fees. Liquidity providers will not make profits from such low fees.

[rat03gopoh]

This is the weakness of current swap router contract, their routing is so confusing and there is no way to determine the real output we gonna get and instead we're only getting minOut or max slippage as a guardrail.

There are simply tons of ways we can lose our money using these dex from malicious delegation, unlimited approval, fake token, low liquidity, to getting front ran by a freaking mev bots .

And funnily enough, the cowSwap exchange solver model is considered the most advanced system currently adopted by many DEXs. I wouldn't say the protocol hasn't undergone extensive testing, but they haven't done so until they exceed a certain amount, say $50 million per execution. https://etherscan.io/tx/0x9fa9feab3c1989a33424728c23e6de07a40a26a98ff7ff5139f3492ce430801f

[Knight Hider]

Does this mean someone else, or a few people, profited $50m?

[MAAManda]

It's scary to see $50M+ become around $36K+, I can't imagine what it would be like if I were that user. Sometimes our enemy isn't external parties like hacker or something like that, but ourselves, something like this doesn't happen just once, it happens repeatedly with different cases with the same source of the problem, human error.

Does this mean someone else, or a few people, profited $50m?

Yes & one of them is those who are liquidity providers.