Aave v3 Unaffected by $305,000 Exploit Targeting Third-Party Adapter
An exploit targeting a third-party adapter drained $305,000 from two Safe multisig wallets, but Aave founder Stani Kulechov confirmed Aave v3 is secure.
Quick Look
- Aave v3 remained unaffected after an exploit drained roughly $305,000 from two Safe multisig wallets using a third-party adapter.
- Blockchain security firm SlowMist reported the attack exploited an access-control flaw.
AI-generated summary
Why It Matters
Aave v3 is a decentralized lending protocol. Third-party adapters often build on top of core protocols to offer leveraged positions.
Aave founder Stani Kulechov said Aave v3 was unaffected by an exploit that drained roughly $305,000 from two Safe multisig wallets through a third-party adapter built on top of the lending protocol.
“This is not Aave v3 contract, it’s third party external adapter built on top of Aave, zero effect on Aave v3,” Kulechov said on X.
Blockchain security firm SlowMist said the attack targeted a module used to open and close leveraged Aave v3 positions through Safe wallets. The attacker exploited an access-control flaw that allowed a fake Safe contract to pass the adapter’s authorization check.
SlowMist said the adapter also allowed the caller to control the router and transaction data used for swaps. The attacker used that functionality to execute transactions through the victim Safes and drain weETH and collateral.
Around 1,300 wrapped Ether (WETH) in debt was repaid during the attack to unlock collateral, according to SlowMist. The attacker ultimately stole about 114.09 Ether (ETH), worth roughly $305,000, from two Safe multisigs.
The security firm identified the vulnerable FlashLoopAdapter contract and the attacker’s wallet but did not report any losses to Aave v3 itself.
Open Questions
- Will the FlashLoopAdapter be permanently patched?
- Can the stolen funds be recovered?
