Aave founder says V3 unaffected by adapter exploit that drained about $305,000

An attacker drained about $305,000 from two Safe multisig wallets through a third-party adapter built on Aave v3. Aave founder Stani Kulechov said the adapter was external to Aave and the exploit had no effect on Aave v3 contracts. Blockchain security firm SlowMist said the attack targeted a module used to open and close leveraged Aave v3 positions through Safe wallets. SlowMist said an access-control flaw let a fake Safe contract pass the adapter's authorization check. SlowMist said the adapter also let the caller control the router and transaction data used for swaps. The attacker used that functionality to execute transactions through the victim wallets and drain weETH and collateral, according to SlowMist. About 1,300 wrapped Ether (WETH) in debt was repaid during the attack to unlock collateral, according to SlowMist. The attacker ultimately stole about 114.09 Ether (ETH), worth roughly $305,000, from two Safe multisig wallets. SlowMist identified the vulnerable FlashLoopAdapter contract and the attacker's wallet but reported no losses to Aave v3 itself.