Hackers exploit third-party Aave adapter to steal about 114 ETH

An attacker exploited a third-party lending adapter built on Aave to steal about 114 ETH, worth over $300,000, while Aave remained unaffected. Blockchain security firm SlowMist said on Oct. 2 that the attacker compromised two Safe multisig wallets through a FlashLoopAdapter flaw affecting Aave v3 positions. SlowMist said the exploit allowed the attacker to bypass authentication checks, execute arbitrary calls and drain collateral from the affected wallets. SlowMist estimated the direct loss at about 114.09 ETH. SlowMist said roughly 1,300 WETH of debt was also repaid during the attack to unlock collateral tied to the positions. Aave founder Stani Kulechov said the incident involved an external third-party adapter, not Aave v3's core smart contracts. Kulechov said the incident had zero effect on Aave v3. Aave is the largest decentralized lending protocol, with more than $33 billion in total value locked. The exploit affected infrastructure built on top of Aave. According to SlowMist, the attacker created a fake Safe contract that always confirmed the adapter was enabled as a module. The adapter accepted the forged authentication and proceeded to its internal swap function. The adapter allowed the caller to specify both the router and the call data used in an external contract call. The attacker directed the router back to the victim Safe. The FlashLoopAdapter was already enabled as a module on the affected wallets, allowing the attacker to execute transactions through the victims' Safes. SlowMist said the attacker used the technique to withdraw weETH and collateral associated with Aave positions from two multisig wallets. The incident illustrates how decentralized finance integrations can create separate vulnerabilities while the underlying protocol's security remains intact. Aave's immediate exposure appears limited to users of the vulnerable adapter. Investigators need to determine how widely the vulnerable module was deployed and whether more positions are at risk. An unresolved question is whether other wallets enabled the same module. Another unresolved question is whether the adapter's developers identify additional affected positions before attackers can reuse the authentication flaw.