Following the execution of the AIP (see September Funding Update) on December 4th to recover remaining funds from the periphery contracts, Aave Labs presents the final technical analysis of the Paraswap integration incident.
Incident Report
Date of detection: Aug 28th, 2024
Severity: Medium
Components Affected: Paraswap-powered periphery contracts (not related to the Aave Protocol)
Summary
On August 28th, a problem was detected with the Paraswap Adapter contracts. These contracts facilitate token swaps and actions such as debt swaps and repay actions within the Aave Interface. Such contracts were identified to have been gathering small token balances (dust) over time from positive slippage that has been continuously transferred to the DAO. On August 28th, an attacker exploited these balances on the contracts through a sophisticated attack for roughly USD 95,000 across all the Aave networks. No core protocol contracts or user funds were affected or at risk.
Incident Timeline
| Date / Time |
Details |
| August 28th at 7:00 CET |
Aave Labs identifies indications of a potential exploit affecting the periphery contracts, triggering internal measures to respond to it. |
| August 28th at 9:00 CET |
BGD Labs confirms to Aave Labs that an exploit may have occurred and advises to disable the “repay with collateral” feature in the Aave Interface, pending further investigation. |
| August 28th at 9:00 CET |
Aave Labs continues the effort to contain the exploit, supported by the additional details provided. |
| August 28th at 9:30 CET |
Aave Labs disables the “repay with collateral” feature in the Aave Interface. |
| August 28th at 10:15 CET |
Aave Labs disables all functionalities related to Paraswap-powered periphery contracts as a precautionary measure. |
Mitigation Timeline
| Date |
Details |
| August 28th |
Aave Labs works collaboratively with BGD Labs and Paraswap teams to identify the issue and develop a mitigation and resolution process. The exploit only affected the periphery contracts, which held assets transferred to the Aave DAO. No user funds were lost, and no core protocol contracts were impacted. |
| September 2nd |
Aave Labs confirms that only two Paraswap-powered features in the Aave Interface were impacted, “repay with collateral” and “debt switch”, and the remaining features are re-enabled. |
| September 2nd |
Aave Labs develops a technical patch for “repay with collateral” functionality and contacts security service provider Certora for a security review. |
| September 9th |
After a successful security review by Certora, Aave Labs re-enables the “repay with collateral” feature across Aave markets. |
| September 10th |
Aave Labs builds a technical patch for the “debt switch” feature and connects with Certora to conduct a security review of it. |
| September 11th |
Certora confirms the “debt switch” patch successfully passes their review. |
| September 17th |
Aave Labs re-enables the “debt switch” feature across Aave markets. However, the “repay with collateral” feature is disabled in V2 markets due to its incompatibility with the implemented solution. |
| October 24th |
Aave Labs upgrades the Aave Interface integration to Paraswap SDK v6. |
| December 4th |
An AIP was executed to rescue remaining funds from Paraswap-powered periphery contracts across all Aave markets. |
Impact
The exploit affected all “repay with collateral” and “debt switch” adapter contracts across Aave markets, resulting in a total value of USD 95,284.44 drained. These funds accumulated as dust over time and were transferred to the DAO, not to any individual user. The remaining adapter contracts (“collateral swap” and “withdraw and switch”) did not accumulate any balance and were not exposed to the exploit.
Root Cause Analysis
The Paraswap-powered adapter contracts were designed to enable token swaps and actions for users, not to hold any balance. Their capabilities are very limited: they can only execute actions through Paraswap and Aave.
The attack was possible by creating a pending approval to the Paraswap Augustus contract. This pending approval could then be used via an arbitrary call on Augustus contract in the context of the Aave Periphery Adapters. This attack vector took advantage of two factors:
-
An unexpected accumulation of token balances in the contract: The leftover token amounts from swaps were expected to be minimal, typically just “dust” (small, insignificant amounts). However, an investigation revealed that the unexpected accumulation was caused by:
a. Incorrect integration of the “repay with collateral” feature: The Aave Interface was passing incorrect data to the adapter contract, which caused an unexpected behavior of the swaps. The result was to have more accumulation of leftovers.
b. Incorrect assumptions about Paraswap’s swaps behavior: The contracts assumed that Paraswap would provide exact output swaps, which is not always the case. There could be leftovers when executing exact output swaps (buy actions).
-
The ability for arbitrary calls through the Paraswap Augustus contract (the main entry point of Paraswap DEX): The Paraswap Augustus contract’s support for arbitrary execution calls enabled the attacker to exploit the remaining assets in the adapter contracts through a two-step process:
a. The attacker initiates a fake swap by tampering with the input parameters passed to Paraswap, simulating a real swap. This action creates a non-zero pending allowance from the adapter contract to Paraswap, setting the stage for the exploit.
b. The attacker initiates a real repayment with collateral action paired with a fake swap. Leveraging the pending allowance, the attacker uses the funds held in the adapter contract to repay their own debt, exploiting the contract’s intended purpose.
Conclusion
The Paraswap incident, which resulted in the accumulation and draining of an unexpectedly high amount of dust in the Aave Protocol’s periphery contracts, has been resolved through a combination of technical patches, upgrades, and community-supported actions.
Firstly, a patch was implemented to the periphery contracts to restrict the execution and approval process, preventing any further accumulation of dust. Additionally, an upgrade to Paraswap v6 was implemented, reducing the possibility of executing arbitrary code. Finally, through an executed AIP, the remaining dust balances were successfully recovered across all affected networks.
The “repay with collateral” feature remains disabled in V2 markets, while all other swap features have been restored across networks with improved security. Moving forward, the current implementation of Paraswap is being reviewed to further harden the security of the Aave Interface and the Aave Protocol. More updates on this ongoing work will be shared in the near future.
The Aave community played a crucial role in the resolution process. Aave Labs extends its gratitude to BGD Labs, Paraswap, Certora, and the broader community for their support in investigating and resolving this incident.