Third-Party Aave Adapter Exploited for 114 ETH
A vulnerability in a third-party lending adapter built for Aave v3 led to the theft of 114 ETH, though Aave's core protocol remains secure.
A third-party adapter designed for Aave v3 was exploited on Oct. 2, resulting in the loss of approximately 114 ETH. The security firm SlowMist reported that the attack targeted two Safe multisig wallets by leveraging a flaw in the FlashLoopAdapter.
The exploit allowed the attacker to bypass authentication checks within the adapter, enabling them to execute arbitrary calls and drain collateral. SlowMist noted that the attacker also repaid roughly 1,300 WETH of debt to unlock collateral associated with the compromised positions.
Aave founder Stani Kulechov confirmed that the incident did not involve Aave v3 core smart contracts, stating that the issue was isolated to an external adapter with no impact on the protocol itself. Aave currently holds over $33 billion in total value locked.
SlowMist identified the vulnerability within the FlashLoopAdapter’s open and close functions. The attacker reportedly used a fake Safe contract to spoof verification checks, tricking the adapter into accepting forged authentication. By exploiting the adapter's ability to specify routers and calldata, the attacker was able to invoke the Safe’s execTransactionFromModule function to withdraw collateral.
The incident serves as a reminder of the risks associated with external integrations in DeFi, where third-party tools can introduce vulnerabilities even when the underlying protocol remains secure. Investigators are now working to determine if other wallets using the same module are at risk.
