Third-Party Plug Pops Aave's Neighbor's Safe, Not Its Own 🕳️

Aave founder Stani Kulechov moved to reassure users that Aave v3 was unaffected by an exploit that drained roughly $305,000 from two Safe multisig wallets via a third-party adapter built on top of the lending protocol. "This is not Aave v3 contract, it's third party external adapter built on top of Aave, zero effect on Aave v3," Kulechov said on X.

Blockchain security firm SlowMist traced the attack to a module used to open and close leveraged Aave v3 positions through Safe wallets. The attacker exploited an access-control flaw that allowed a fake Safe contract to pass the adapter's authorization check, according to SlowMist.

The adapter also permitted the caller to control the router and transaction data used for swaps. SlowMist said the attacker used that functionality to execute transactions through the victim Safes and drain weETH and collateral, with around 1,300 wrapped Ether (WETH) in debt repaid during the attack to unlock collateral.

The security firm identified the vulnerable FlashLoopAdapter contract and the attacker's wallet, noting that the attacker ultimately stole about 114.09 Ether (ETH), worth roughly $305,000, from two Safe multisigs. SlowMist reported no losses to Aave v3 itself.