Aave Hack

Reported loss $56K
Ethereum
Other

What happened

On 2024-08-28 an attacker drained token balances from Aave's ParaSwap-powered periphery adapters, the "repay with collateral" and "debt switch" contracts used by the Aave Labs interface, across Aave markets on several networks. These adapters are not part of the core protocol and do not hold user deposits. Over time, though, they had accumulated leftover tokens from positive slippage on swaps, and that balance belonged to the Aave DAO. Early reports put the loss at about $56,000. Aave Labs' final analysis (2024-12-20) put the total drained at USD 95,284.44 and confirmed that no user funds were affected.

Two problems combined. The adapters had built up unexpected balances because of an incorrect integration of repay-with-collateral and wrong assumptions about how ParaSwap handles exact-output swaps. On top of that, _buyOnParaSwap approved ParaSwap's Augustus contract for the swap amount but did not validate the caller-supplied paraswapData, did not check the swap outcome, and did not reset the allowance. The attacker could leave a pending allowance behind and then spend it through an arbitrary call.

Aave disabled all ParaSwap-powered features on 2024-08-28. It re-enabled them between 2024-09-02 and 2024-09-17 after patches reviewed by Certora and moved to ParaSwap SDK v6 on 2024-10-24. A governance proposal executed on 2024-12-04 rescued the remaining funds from the periphery contracts. Exploiter: 0x6ea83f23795F55434C38bA67FCc428aec0C296DC. Example exploit transaction on Ethereum: 0xc27c3ec61c61309c9af35af062a834e0d6914f9352113617400577c0f2b0e9de.

How it happened

  1. The attacker called a ParaSwap adapter with crafted paraswapData describing a fake swap. The adapter approved ParaSwap's Augustus contract for the swap amount, and because the swap did not consume it and the adapter never reset it, a pending allowance was left behind.
  2. The attacker then started a real repay-with-collateral action paired with another fake swap. The unvalidated paraswapData let this path make an arbitrary call through Augustus.
  3. That call spent the pending allowance and moved the adapter's accumulated token balance to the attacker.
  4. The attacker repeated this against the repay-with-collateral and debt-switch adapters across Aave markets, draining about $95K in total.

Protocol details

Classification Borrowing and Lending / Access Control
Protocol Type Exploit/Other
Implementation language Solidity
Protocol links Website @aave

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Same attack technique

Browse all hacks →
Base Internet Token INT $16K lost BNB Chain Chainge Finance $716K lost Ethereum BasketDAO $1.2M lost Ethereum CoW Swap $180K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes