CoW Swap solver failure caused $50M trade to execute catastrophically, swapping aUSDT for 324 aAAVE due to stale gas limits and possible mempool leak.
Security & Exploits ·
On March 12, 2026, a $50M collateral swap executed through Aave v3 and CoW Protocol resulted in a user receiving approximately 324 aAAVE tokens for aUSDT at extreme loss. The transaction was final and irreversible onchain. The failure stemmed from multiple compounding issues: a fill-or-kill order on an illiquid pair, a quote verification system using a stale 12M gas unit ceiling that rejected better-priced quotes, a winning solver that subsequently failed to execute onchain, and a transaction that may have leaked from a private mempool.
The swap began when the user requested a quote for underlying assets (USDT to AAVE) through the Aave v3 front end, but the actual order traded the aToken pair (aUSDT to aAAVE). Three solvers responded to the initial quote phase. Solver C's route required approximately 20M gas units, exceeding the hardcoded 12M ceiling, causing the simulation to fail; Solver B reverted legitimately. This left Solver A's verified quote of approximately 329.75 AAVE, about 150–200x worse than unverified alternatives, which became the order's limit price at 324.9492 aAAVE. The user received explicit warnings about extreme price impact exceeding 30% and manually confirmed the order through multiple steps before submission.
The order proceeded through three consecutive CoW Protocol auctions and was ultimately executed. Technical fixes addressing the identified infrastructure issues have begun, with one already deployed. Investigations into solver execution failures and the potential mempool leak remain ongoing, though the transaction itself cannot be reversed.