Security firm SlowMist reported the theft of approximately 114 ETH through exploitation of the FlashLoopAdapter module, a third-party adapter designed to manage leveraged positions on Aave v3. The attacker bypassed access control by deploying a fake contract masquerading as a Safe wallet, then manipulated the module’s internal swap function to execute arbitrary instructions. Two Safe multisig wallets were drained of their weETH collateral after repaying over 1,300 WETH borrowed on Aave to unlock the collateral. The Aave v3 protocol itself was not compromised: the vulnerability resided in an external integration layer. SlowMist advises Safe users to regularly audit active modules and deactivate any that are no longer needed.
Source: Read the original article
