WuBlockchain
SlowMist issued a security alert confirming that Aave v3's Loop Safe Module was exploited through an access-control vulnerability in the FlashLoopAdapter's open() and close() functions. The attacker bypassed Safe multisig authorization and executed arbitrary modules, draining approximately 114.09 ETH from two Safe addresses.
The attacker also repaid around 1,300 WETH in outstanding debt during the exploit, a move that unlocked collateral and let the stolen funds exit cleanly. The dual flow, debt repayment on one side, ETH extraction on the other, points to an actor who understood the Aave v3 accounting flow well enough to monetize the access-control bypass rather than just siphoning the obvious target.
Why it matters
The exploit vector is the more serious signal than the dollar figure. The vulnerability sat in the access-control checks on FlashLoopAdapter's open() and close() entry points. A Safe multisig is only as secure as the modules it approves, and this incident shows what happens when a module's permission model can be subverted.
Market impact
At roughly 114 ETH, the loss is small in absolute terms, and Aave's core lending markets were not directly compromised. The watch item is whether the same access-control pattern appears in other adapters or module wrappers. SlowMist's disclosure should put every team that has integrated similar module patterns on notice to audit the open and close paths against unauthorized callers.
Frequently asked questions
-
How much was stolen in the Aave v3 exploit?
Approximately 114.09 ETH was drained from two Safe multisig addresses. The figure is small in absolute terms and Aave's core lending markets were not directly compromised.
-
What vulnerability was used in the Aave v3 exploit?
An access-control flaw in the FlashLoopAdapter's open() and close() functions let the attacker bypass Safe multisig authorization and execute arbitrary modules.
-
Were Aave's core lending markets affected?
No. The exploit hit the Loop Safe Module through the FlashLoopAdapter integration. Aave's core lending markets were not directly compromised.
-
Why did the attacker repay 1,300 WETH in debt during the exploit?
The repayment unlocked collateral that let the stolen ETH exit cleanly, suggesting the actor understood Aave v3's accounting flow well enough to monetize the access-control bypass.
-
What should other DeFi teams learn from this incident?
Safe multisigs are only as secure as the modules they approve. Teams shipping similar adapter or module patterns should audit the open and close paths against unauthorized callers.
Crypto News
CoinTelegraph
TheBlock
CoinDesk
CryptoSlate