On August 28, 2024, the ParaSwapRepayAdapter peripheral contract of Aave was exploited for approximately $56,000. The _buyOnParaSwap function had excessive token allowances that weren't properly adjusted after swap failures, allowing attackers to exploit unvalidated paraswapData parameters and drain accumulated slippage tokens.

The DeFi lending platform Aave was attacked due to a contract vulnerability. The attack occurred in a smart contract outside of Aave's core protocol, which is used to allow users to repay loans using existing collateral. The attacker exploited an arbitrary call error, successfully stealing around $56,000 from these various contracts. Aave representatives emphasized that the attack posed no risk to user funds and did not affect the security of the core Aave protocol.