Leaderboard
1169All-time rank
A
Aave
Aug 28, 2024
$56K
Lost
$56K
Recovered
$0
Net loss
$56K
Unrecovered0% recovered
On August 28, 2024, the ParaSwapRepayAdapter peripheral contract of Aave was exploited for approximately $56,000. The _buyOnParaSwap function had excessive token allowances that weren't properly adjusted after swap failures, allowing attackers to exploit unvalidated paraswapData parameters and drain accumulated slippage tokens.
How the exploit worked
View reproducible PoCArbitrary Call Error.
Lost: 52000
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Arbitrary External Call
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Aug 28, 2024Exploit executed — $56K drained via arbitrary external call
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)