Digital Asset
Intelligence
Security Incident · Avalanche Ecosystem

Custom sAVAX Aave Rebalancer contract Smart Contract Vulnerability: $64.00K Reported Loss

·Historical incident record

Incident Overview

A custom sAVAX Aave Rebalancer contract on Avalanche was exploited. The public function b2a13230() allowed the caller to pass arbitrary target and data, executing target.call(data) while the contract still held the user’s Aave V3 Credit Delegation (borrowing permission). The attacker used this to call Aave’s borrow() on behalf of the victim and drain WAVAX. A whitehat bot frontran the transaction and recovered all funds before any withdrawal, resulting in zero net loss to the user.

Sources & References

Original incident referencehttps://telemetr.io/uz/channels/2360854548-defimon_alerts (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodMisconfiguration
    Reported loss$ 7,450,000
  2. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 1,013,000
  3. Incident date
    Target

    Seedify

    Attack methodPrivate Key Leakage
    Reported loss$ 1,700,000
  4. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 50,000
  5. Incident date
    Target

    Vercel

    Attack methodSupply Chain Attack
    Reported lossNot disclosed