HypurrFi Exposes Rounding Error Vulnerability in Aave V3, Pauses Markets
HypurrFi, a lending platform on Hyperliquid's HyperEVM, has flagged a critical rounding error vulnerability in Aave V3's core code prior to version 3.5. The discovery prompted an immediate pause on XAUTO and UBTC markets to safeguard $26.5 billion in user deposits. This contrasts sharply with Aave Labs' recent V4 upgrade report claiming zero critical vulnerabilities after a year of testing.
The security gap was detected through HypurrFi's internal monitoring systems, revealing flaws in Aave V3's calculation logic. While allowing continued withdrawals and repayments, HypurrFi has collaborated with Aave deployers and security researchers to address the issue. The platform is urging other Aave fork projects to review their implementations, suggesting the vulnerability may extend beyond its own markets.
The timing proves awkward for Aave Labs, coming just as it pushes for widespread adoption of its V4 upgrade. The protocol generated $120 million in revenue last year according to Defillama, but this incident may fuel existing debates about upgrade urgency. Market participants are now scrutinizing whether the V4's purported security improvements adequately address such fundamental calculation flaws.
