On March 13th, Aave founder Stani.eth responded to the news that "a user lost over $50 million due to slippage when buying AAVE" : Given the unusually large order size, the Aave interface, like most trading interfaces, warns users of abnormal slippage and requires confirmation via a checkbox. The user confirmed the warning on their mobile device, accepted the high slippage, and continued the exchange, ultimately receiving only about 324 AAVE. Transactions must explicitly accept the risk by confirming the checkbox; otherwise, they cannot continue.
The CoW switching router worked as expected, and the integration followed industry standard specifications. However, while users were able to continue switching, the end result was clearly far from optimal. Similar events do occur in DeFi, but the scale of this transaction was far larger than what is typically seen in this space. We sympathize with the user, will attempt to contact them, and will refund the $600,000 fee charged in the transaction.
The key takeaway is that while DeFi should remain open and permissionless, allowing users to trade freely, the industry can still build additional safeguards to better protect users. Our team will explore ways to improve these safeguards in the future.
