Bug in Aave V2 Polygon causes some assets to be stuck in contracts

A bug in an older version of crypto lending protocol Aave is preventing users from interacting with Wrapped Ether (WETH), Tether (USDT), Wrapped Bitcoin (WBTC) or Wrapped Matic (WMATIC) pools on the Aave V2 polygon preventing them from withdrawing, as per the May 19 resolution that attempts solve Bug via a patch. The proposal states that users are currently “unable to supply, borrow, repay, or withdraw more of those assets.”

While withdrawals are currently impossible, the team said the funds are “completely safe” as the bug may be fixed after the governance vote.

,@AaveAave The latest upgrade to ReserveInterestRateStrategy in Aave V2 (Polygon) has temporarily halted the protocol, affecting ~$110M worth of assets!
Root Cause The new ReserveInterestRateStrategy is only compatible with Ethereum, not compatible with Polygon. pic.twitter.com/Ze3zSBS8Ck

— BlockSec (@BlockSecTeam) May 19, 2023

The bug only affects Aave V2 on polygons. AaveV3, which is the most recent version, remains unaffected, as do V2 deployments in Ethereum or Avalanche.

May 16 interest rate curve patch caused broken code Applicable For all deployments of V2. V2’s Polygon implementation uses a slightly different list of function definitions (called “interfaces”) for its rate strategy contracts compared to the Ethereum and Avalanche implementations. But interest rate curve transformations didn’t take this difference into account, causing the bug to develop only in polygon deployments.

The new proposal asks Aave’s governing body, the Aave DAO, to only approve code changes to the Polygon version to fix patches. The resolution states that polling is to begin on May 20 and go on till May 23.

Connected: Aave DAO votes for ‘rescue plan’ to save lost tokens

Aave is most famous for its instant loan feature that allows users to borrow, trade, and repay crypto within the same block without the need for collateral. It started on Ethereum, but has been expanding to other networks over the past few years. On April 17, the Aave governance voted to implement the protocol on ZkSync Era, a Layer 2 version of Ethereum that uses zero-knowledge proof technology. On May 8, Aave v3 was deployed to the Metis network, which is also the second layer of Ethereum.