Hackers exploit Aave tool to steal 114 ETH

A third-party lending adapter built on Aave was exploited to steal approximately 114.09 ETH, valued over 300000 dollars, while the Aave protocol itself remained unaffected. On Oct. 2, blockchain security firm SlowMist reported that the attacker compromised two Safe multisig wallets through a flaw in the FlashLoopAdapter used with Aave v3 positions. This exploit allowed the attacker to bypass authentication checks, execute arbitrary calls, and drain collateral from the affected wallets. SlowMist noted that around 1300 WETH of debt was also repaid during the attack to unlock collateral tied to the positions. Aave founder Stani Kulechov clarified that the incident did not involve Aave v3's core smart contracts, stating it was a third-party external adapter with zero effect on Aave v3. The vulnerability was traced to the FlashLoopAdapter's open() and close() functions, which could be spoofed. The attacker created a fake Safe contract that falsely confirmed the adapter was enabled, allowing the adapter to accept forged authentication and execute internal functions. The adapter also permitted the caller to specify the router and calldata for external contract calls. The attacker directed the router back to the victim Safe and invoked Safe's execTransactionFromModule function, enabling the withdrawal of weETH and collateral from the multisig wallets. This incident underscores a recurring risk in decentralized finance, where protocol security can remain intact while integrations create separate vulnerabilities.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.