Bug in Aave V2 Polygon causes some assets to become stuck in contracts


A bug in an older version of the Aave crypto lending protocol prevents users from interacting with Wrapped Ether (WETH), Tether (USDT), Wrapped Bitcoin (WBTC), or Wrapped Matic (WMATIC) pools in Aave V2 Polygon, preventing that assets be withdrawn from them, according to a May 19 proposal that seeks to arrange the bug through a patch. The proposal says that users currently cannot "offer more of those assets, borrow, pay or withdraw."

Although withdrawals are currently impossible, the team claimed that the funds are "perfectly safe" as the bug can be fixed after a government vote.

The bug only affects Aave V2 on Polygon. AaveV3, which is the most recent version, is not affected, as are V2 implementations on Ethereum or Avalanche.

The broken code arose due to a May 16 interest rate curve patch. applied to all implementations of V2. The V2 Polygon implementation uses a slightly different list of feature definitions (called an "interface") for its fee strategy contracts compared to the Ethereum and Avalanche implementations. But changes in the interest rate curve did not account for this difference, causing the bug to develop only in the Polygon implementation.

The new proposal asks Aave's governing body, the Aave DAO, to approve code changes only in the Polygon version to fix the patch. Voting is scheduled to begin May 20 and continue through May 23, according to the proposal.

Related: Aave DAO votes for 'bailout plan' to save lost tokens

Aave is best known for its flash lending feature that allows users to borrow cryptocurrency, transact, and repay the loans within the same block without the need for collateral. It started on Ethereum, but has been expanding to other networks in recent years. On April 17, the Aave government voted in favor implement the protocol in zkSync Era, a layer 2 of Ethereum that uses zero-knowledge proof technology. May 8, Aave V3 deployed on the Metis networkwhich is also a layer 2 of Ethereum.