Safe wallets taught a $305K lesson: trust, but verify your modules 🕳️🐇

Two Safe wallets lost a combined 114.09 ETH, roughly $305,000, after a custom FlashLoopAdapter built to manage leveraged Aave V3 positions was exploited on Ethereum. SlowMist issued a security alert on Friday, October 2, identifying an access-control vulnerability in the adapter's open() and close() functions, while blockchain security account Defimon Alerts said it detected the attack at 15:08:57 UTC on Thursday, October 1.

The attacker spoofed a Safe authentication check by deploying a malicious contract that posed as a Safe and returned the expected value, passing a verification step meant to confirm that a legitimate wallet had enabled FlashLoopAdapter. Because the same contract also supplied the adapter's swap router and calldata, it was able to direct the router at a victim Safe and invoke execTransactionFromModule. FlashLoopAdapter was already enabled on that wallet, so the Safe accepted the call as an authorized module transaction, converting a narrow authentication flaw into broader access.

Once inside, the attacker used a Morpho WETH flash loan to repay outstanding debt and unlock collateral. SlowMist noted that 1,306 weETH withdrawn from one wallet represented gross transaction flow rather than the attacker's net proceeds, leaving an estimated net loss of about 114.09 ETH across the two Safe wallets. The on-chain footprint was first flagged by Wu Blockchain, which summarized SlowMist's findings.

The incident highlights the risks of composable DeFi modules and custom adapters that extend Safe wallet functionality, particularly those managing leveraged lending positions on protocols such as Aave V3. Users employing such modules are urged to review access-control assumptions, verify which contracts can invoke execTransactionFromModule, and monitor for router or calldata parameters not set by the wallet owner.

No statement from the FlashLoopAdapter developer or Aave governance was included in the published analyses, and the funds have not been reported as recovered.