A security flaw in a module connected to Aave V3 allowed an attacker to bypass Safe wallet authorization and drain about $305,000 in crypto from two multisignature wallets.
Blockchain security firm SlowMist has issued a security alert over an exploit involving Aave V3’s Loop Safe Module.
Aave V3 Module Exploit
According to SlowMist, the attacker exploited two weaknesses in the system. The first was an access-control flaw in the FlashLoopAdapter, a module designed to manage leveraged Aave V3 positions through Safe wallets.
Sponsored
Crypto Prediction Markets
18+ · Gambling involves risk. Play responsibly.
The vulnerability allegedly allowed the attacker to bypass Safe’s authorization checks and run unauthorized modules. The attacker created a fake Safe contract that passed the module’s checks, tricking the system into treating it as a legitimate wallet.
In practice, it only asked whether the wallet claimed to trust the contract, allowing the attacker to create a fake Safe that always answered “yes.”
How the Safe Wallet Attack Worked
The second weakness involved the contract’s handling of swaps. It gave the caller too much control over both where instructions were sent and what those instructions contained.
The attacker used this to target the victims’ own Safe wallets and instruct them to transfer funds. Because the module was already trusted by the victims’ wallets, the wallets followed those instructions.
The entire attack happened in a single transaction, starting with a WETH flash loan from Morpho. The attacker used the borrowed funds to repay roughly 1,300 WETH in Aave debt held by the wallets. Repaying the debt unlocked the collateral securing those loans, which the attacker then withdrew.
According to SlowMist, about 114.09 ETH, worth around $305,000 at the time of the incident, was stolen from two Safe multisig wallets.
Two Safe Wallets Were Drained
The incident involved two Safe multisig wallets using the affected module. The attack relied on weaknesses in the module’s access-control and swap functionality.
There is no indication so far that funds deposited directly on Aave were affected.
Aave Has Not Issued a Public Response
Neither the Aave protocol nor the module’s developers have issued a public statement regarding the incident.
There is no confirmed fix, shutdown, or compensation plan at this time. Aave has also not published an official loss breakdown or security notice.
Why Safe Modules Can Create Security Risks
Safe wallets are modular, allowing users to add tools that automate strategies or connect to protocols such as Aave. But those modules can also create new security risks: if a module has permission to move funds and contains a flaw, the wallet’s normal multisig protections may not stop an unauthorized transaction.
Why This Matters
The incident shows that a vulnerability in a third-party module can bypass the protections of a Safe wallet that has already authorized it. It also highlights that users’ exposure can depend on the specific modules and integrations connected to their wallets, not just the underlying Aave protocol.
Explore DailyCoin’s top crypto news right now:
MetaMask Investigates Security Incident, Exits Ethereum Validators
HBAR Price Map Points To a $0.15 Fifth-Wave Push
Be the first to comment