# AaveRebalancer: arbitrary call abuses credit delegation to drain WAVAX

AaveRebalancer's arbitrary external call let an attacker borrow 7,000 WAVAX against a victim's credit delegation, then transfer it out.

- Payout: Real-world hack
- Severity: high
- Program: AaveRebalancerCreditDelegation
- Credited: DefimonAlerts
- Disclosed: 2026-04-19
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/AaveRebalancerCreditDelegation_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260419-aaverebalancercreditdelegation
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** sAVAX rebalancer contract on Avalanche
**Root cause:** The rebalancer executes caller-supplied target and calldata from its own address, and the victim had granted it max WAVAX borrow allowance via Aave credit delegation.
**Steps:**
1. Attacker sets up a tiny Aave position: supply 1e6 USDC, approveDelegation to rebalancer, transfer 0.001 sAVAX to rebalancer.
2. Call rebalancer selector `0xb2a13230` with `(0.01e18, AAVE_POOL, abi.encodeWithSelector(pool.borrow.selector, WAVAX, 7000e18, 2, 0, VICTIM), true)`.
3. Rebalancer calls Aave Pool.borrow as itself; Aave mints 7000 WAVAX variable debt to VICTIM and sends WAVAX to rebalancer.
4. Call rebalancer again with `(0.01e18, WAVAX, abi.encodeWithSelector(wavax.transfer.selector, attacker, balance), true)` to pull WAVAX out.
5. Repay only the attacker's small setup debt, leaving victim's debt increased by ~7000 WAVAX.
**How found:** Likely identified that the rebalancer accepts arbitrary target/data and executes from its own address, then checked on-chain that a victim had delegated max WAVAX borrow allowance to it, enabling a borrow on the victim's behalf.
**Exploitation:** Attacker used the rebalancer's arbitrary-call surface to invoke Aave Pool.borrow with the victim as onBehalfOf, exploiting the victim's max credit delegation to the rebalancer. The borrowed WAVAX landed in the rebalancer, then a second arbitrary call transferred it to the attacker. Attacker repaid only their own tiny setup debt, leaving the victim with ~7000 WAVAX debt.
**Insight:** When a contract performs arbitrary external calls from its own address, check what token approvals or credit delegations it holds; any delegated borrowing power can be turned into a borrow on the delegator's behalf.