Avraham Eisenberg's 'Profitable Trading Strategy' on Aave

Note: Not Financial Advice

‍

On October 19th 2022, Avraham Eisenberg made a series of Twitter posts illustrating a "profitable trading strategy" on popular DeFi lending platform Aave. Since then Crypto Twitter has been ablaze with discussion of a potential attack on the platform. Eisenberg has previously claimed involvement with the Mango Markets exploit, as well as the OHM fork FortressDAO. With 9 figures of successful exploits under his belt, Eisenberg’s proposal should not be dismissed.

‍

Arkham Research looked into how it could have worked, coming to the conclusion that this kind of exploit could threaten not just Aave but lending protocols in general. This post will give a step-by-step description of how an attacker could have exploited the platform, before many of the most vulnerable lending markets were paused on October 25th 2022.

‍

‍

Firstly, $100 million $USDC is deposited on Aave using Account A. Account A then borrows the entire liquid supply of $REN ($3 million), sending this to Account B. Account B then deposits this back on Aave. This now allows the $3 million of liquid $REN to be able to be borrowed, again on Account A. Aave cannot verify whether the deposited $REN is new, or just comes from its own platform; as such, each time Account B deposits $3m $REN, Account A can borrow it - over and over. This builds up two massive long/short positions on a relatively illiquid token.

‍

On Aave, $USDC has an LTV (Loan-to-Value) ratio of 87%. This means that Account A, after depositing $100m of $USDC, can borrow up to $87 million of any liquid token on Aave, and this process can be repeated to build up a synthetic $REN short position to the tune of $85 million, while Account B is long (lending) the same amount of $REN. The strategy appears delta-neutral until liquidity constraints are taken into account - positions can be built large enough that they are practically impossible to effectively liquidate. Unfortunately, the price of $REN needs to move only around 5% to the upside in order to trigger a massive liquidation of Account A.

‍

When that happens, Aave will try to buy $85 million of $REN back with $100 million $USDC. A futile task when it is taken into consideration that this amount is around 70% of the current circulating supply of $REN. Eisenberg puts it a little more explicitly in a Tweet: "once [$REN] sellers run out of coins - price goes vertical".

‍

In addition to this, Eisenberg suggests that with another $50 million USD, a fund could significantly affect the market price of $REN in order to trigger this process. Borrowing $50 million against Account B would bring this to $100 million: enough capital to 2x, 4x, or even 10x the price of $REN. However, while Aave struggles to liquidate Account A's debt, Account B reaps the rewards. If the fund managed to use its liquid capital to 10x the price of $REN across major exchanges, then the original position of Account B would now be worth $850 million.

‍

‍

$REN is considered lower quality collateral than $USDC - as such its LTV ratio is merely 60%. Even so, almost $500 million worth of assets from Aave could be borrowed against Account B if the price of $REN shot up by a factor of 10. This loss would be incurred by users of the Aave platform, and would also be greater than 3x Aave's entire treasury balance.

‍

In light of Eisenberg's comments, tokenholders scrambled to pause borrowing on certain assets, including $REN. These may, however, simply be stopgap measures. With over $5.6 billion of TVL, Aave's platform is one of the largest in all of DeFi - and without fundamental mechanism change, deposits in DeFi may not be as safe as users believe.

‍

‍

As larger and larger entities enter the DeFi space, are so many of the 'blue chips' so big that they cannot fail? A future exploiter may not be so kind as to post a 'how-to' on twitter.

‍