Security Incident · Avalanche Ecosystem
Custom sAVAX Aave Rebalancer contract Smart Contract Vulnerability: $64.00K Reported Loss
A custom sAVAX Aave Rebalancer contract on Avalanche was exploited.
- Reported loss
- $ 64,000
- Attack category
- Smart Contract Vulnerability
Incident Overview
The public function b2a13230() allowed the caller to pass arbitrary target and data, executing target.call(data) while the contract still held the user’s Aave V3 Credit Delegation (borrowing permission). The attacker used this to call Aave’s borrow() on behalf of the victim and drain WAVAX. A whitehat bot frontran the transaction and recovered all funds before any withdrawal, resulting in zero net loss to the user.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.