20 lines (12 loc) · 883 Bytes

Aave Base: `repay(MaxUint256, onBehalfOf != msg.sender)` reverts

This repository contains a sanitized incident report about a Base Aave V3 Pool behavior that can brick non-upgradeable helper contracts that rely on:

Pool.repay(asset, type(uint256).max, rateMode, onBehalfOf)

when the caller is a third-party contract and onBehalfOf != msg.sender.

What’s included (sanitized)

docs/incidents/INCIDENT.md – summary + root cause (no operational secrets)
docs/incidents/EVIDENCE.json – on-chain helper balance + revert selector + static-call proof (redacted owner address)
docs/incidents/AAVE_MESSAGE.md – copy/paste message for Aave governance forum + Discord

What’s intentionally NOT included

No private keys, RPC keys, .env
No step-by-step salvage playbooks from compromised wallets
No additional scripts beyond read-only proof