AaveRebalancerCreditDelegation exploit analysis
AaveRebalancer's `creditDelegation` accepted a delegatee registered through a public register function, so the attacker registered themselves and walked an arbitrary account's debt out. DeFiHackLabs reconstructs the drain.
- Reported loss
- 6,999.91 WAVAX, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-19: Arbitrary External Call Credit Delegation Abuse on AaveRebalancerCreditDelegation”.
Analysis1 min read
AaveRebalancer's creditDelegation accepted a delegatee argument that the caller had registered through a public register function. The attacker registered themselves as the delegatee for any account, called creditDelegation to bring that account's debt to themselves, and walked the borrowed balance out.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a creditDelegation path that requires the delegator's signature on the delegatee, not just a public registration.
Other exploits
- KipseliPropAMM exploit analysis 21 Apr 2026
- JuiceboxREVLoans exploit analysis 20 Apr 2026
- ThetanutsVaultShareRounding exploit analysis 20 Apr 2026
- XLootStaking exploit analysis 15 Apr 2026
- MONA LisaVault exploit analysis 14 Apr 2026
- Saturn Protocol exploit analysis 14 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
