$56 000 USD

AUGUST 2024

GLOBAL

AAVE

DESCRIPTION OF EVENTS

"Aave is a decentralized non-custodial liquidity protocol where users can participate as depositors or borrowers. Depositors provide liquidity to the market to earn a passive income, while borrowers are able to borrow in an overcollateralized (perpetually) or undercollateralized (one-block liquidity) fashion."

 

"Aave is one of the largest DeFi protocols with billions of dollars in weekly volume across Ethereum and 12+ networks."

 

"Peace of mind supported by multiple audits by the world’s leading security firms." "Security is a top priority. Report vulnerabilities or bugs responsibly and get rewarded."

 

"The [periphery] contract has slippage protections, but full dust cleanup from itself is not a feature, and dust has been accumulated after a long period of time and numerous transactions. No funds were extracted from any user in these transactions, and all users funds are totally safe in what relates to Aave."

 

"The vulnerability in the _buyOnParaSwap function which has several issues. It approves assetToSwapFrom tokens based on amount of maxAmountToSwap, but make arbitrary call on a different amount in paraswapData. So the attacker can craft a small swap data but a very high maxAmountToSwap which will leave a very high allowance left for tokenTransferProxy after the swap."

 

"ParaSwapRepayAdapter, isn’t part of the core Aave protocol and appears not to have been audited. It allows users to repay borrow positions using existing collateral, swapping assets via decentralized exchange ParaSwap.

 

While the contract itself isn’t designed to hold user funds, the positive slippage on swaps leads to a gradual accrual of any leftover tokens."

 

"The attacker exploited an arbitrary call error, successfully stealing around $56,000 from these various contracts."

 

"The popular defi lending platform, Aave, suffered a smart contract exploit that allowed an attacker to steal around $56,000. A smart contract outside of the core Aave protocol, which is used to allow people to use existing collateral to repay their loans, had gradually accrued a balance of tokens leftover from slippage. These small leftover token amounts are sometimes called "dust". Altogether, these tokens amounted to around $70,000 across several blockchain networks."

 

"An exploiter was able to take advantage of an arbitrary call error that allowed them to steal funds from these various contracts, amounting to around $56,000."

 

"An exploiter was able to take advantage of an arbitrary call error that allowed them to steal funds from these various contracts, amounting to around $56,000."

 

"According to analysis by security firm QuillAudits, the losses to attacks on the above networks totaled approximately $51,000. A further attack on Avalanche netted around $5,000. Funds were forwarded to a holding address on all networks."

 

"Aave, which contains assets worth over $11 billion according to data from DeFiLlama, has made clear that the attack, which began, around 04:30 UTC placed no user funds at risk. Founder Stani Kulechov and governance delegate Marc Zeller both took to X (formerly Twitter) to reassure users."

 

"Aave representatives emphasized that the attack posed no risk to user funds and did not affect the security of the core Aave protocol." "Various people associated with Aave emphasized that there was no risk to user funds or flaw in the core Aave protocol, and one described the hack as "raiding the tip jar"."

 

"Following the hack, Stani Kulechov, the founder of Aave, along with other key figures, took to social media to reassure the community. Kulechov described the incident as a "tip jar arbed," indicating that the loss was not significant in the broader context of Aave’s operations. However, the incident sparked a renewed debate within the DeFi community."

 

"For precaution, the maintainer of http://app.aave.com (Aave Labs) has temporarily disabled those features and any other of similar nature while we finish the research."

 

"In response to questions about the origin of the funds stolen, Aave delegate Marc Zeller said, “Someone raided the tip jar.”

 

Aave development contributor BGD Labs later responded with more detail, informing users that losses were limited to the affected contracts and couldn’t spread to the wider protocol. The post also highlights that there’s no risk of a token approval-related attack."

Aave is one of the largest liquidity protocols on the blockchain. Periphery contracts assist with users interacting with the protocol, but are not part of the core contract. Over time, these contracts have gradually accumulated dust from transactions that impacted the protocol. On August 27th, the built up dust was removed through an exploit of the smart contract. No user funds were lost in this exploit.

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.