Paper: arXiv 2302.04068

Authors: Lioba Heimbach, Eric G. Schertenleib, Roger Wattenhofer

Abstract

Anxiety levels in the Aave community spiked in November 2022 as Avi Eisenberg performed an attack on Aave. Eisenberg attempted to short the CRV token by using funds borrowed on the protocol to artificially deflate the value of CRV. While the attack was ultimately unsuccessful, it left the Aave community scared and even raised question marks regarding the feasibility of large lending platforms under decentralized governance. In this work, we analyze Avi Eisenberg’s actions and show how he was able to artificially lower the price of CRV by selling large quantities of borrowed CRV for stablecoins on both decentralized and centralized exchanges. Despite the failure of his attack, it still led to irretrievable debt worth more than 1.5 Mio USD at the time and, thereby, quadrupled the protocol’s irretrievable debt. Furthermore, we highlight that his attack was enabled by the vast proportion of CRV available to borrow as well as Aave’s lending protocol design hindering rapid intervention. We stress Eisenberg’s attack exposes a predicament of large DeFi lending protocols: limit the scope or compromise on ‘decentralization’.

Complexity vs Empirical Score

  • Math Complexity: 2.5/10
  • Empirical Rigor: 7.5/10
  • Quadrant: Street Traders — practical and empirical, lighter on theory

Why this score: This paper presents a strong empirical post-mortem of a real-world DeFi exploit (Avi Eisenberg’s attack on Aave), providing valuable insights into economic vulnerabilities and protocol design. While it relies heavily on blockchain and exchange data analysis rather than complex mathematical derivations, its real-world relevance and thorough forensic methodology make it highly rigorous.

Research Flowchart

  flowchart TD
    A["Research Goal: Analyze Avi Eisenberg's Aave Attack & Vulnerabilities"] --> B["Data Inputs: November 2022 Aave Transactions, On-Chain/CEX Data & CRV Borrow Volume"]
    B --> C["Methodology: Track CRV Borrowing, Short Selling, & Protocol Response"]
    C --> D["Computational Analysis: Calculate Impact on CRV Price & Bad Debt Generation"]
    D --> E["Findings: Attack Failed but Generated >$1.5M Irretrievable Debt (4x Increase)"]
    E --> F["Core Insight: Attack Exposed Vulnerabilities in Slow Governance vs. Need for Rapid Intervention"]