Custom sAVAX Rebalancer Hack
What happened
On April 19, 2026, a custom sAVAX rebalancer on Avalanche was exploited to draw approximately $64,000, or about 7,000 WAVAX, against a user's Aave V3 credit delegation. A whitehat bot frontran the attempt and recovered the funds before withdrawal.
The rebalancer exposed an arbitrary external call while retaining delegated Aave borrowing authority, without an allowlist for targets or validation of calldata.
How it happened
While the rebalancer held a user's Aave V3 credit delegation, its public rebalancing function accepted attacker-controlled call target and calldata. The attacker used that path to call Aave borrow on behalf of the delegated user.
Protocol details
Security review history
- Halborn View report
- Code4rena View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
