Attacker Forged a Safe Authorization Check to Drain 114 Ether From an Aave Looping Module

An attacker drained 114.09 Ether, worth roughly $305,000, from two Safe multisig wallets on Ethereum on October 2 by exploiting a third-party adapter those wallets had enabled as a module. Security researchers at DeFiHackLabs published a reproducible proof of concept labelling the root cause broken self-attestation.

The vector was access control, and the flaw was in who answered the authorization question. The adapter's open and close functions did not independently establish that the caller was a genuine Safe. They asked the calling contract whether the adapter was enabled as one of its modules, by calling isModuleEnabled on msg.sender. The attacker deployed a contract that simply returned true, then directed the adapter to execute arbitrary actions on its behalf. SlowMist, which traced the transactions, reported that the attacker took a Morpho flash loan in wrapped Ether, repaid roughly 1,300 wrapped Ether of debt to unlock the victims' collateral, and kept the surplus. Aave's core lending pools and the Safe wallet contracts themselves were used as designed and were not compromised. No recovery or freeze has been reported.

Two smaller incidents followed the same week. DeFiHackLabs published a proof of concept for an attack on SKYDAO worth about 59,900 Tether, in which the attacker burned tokens held by the liquidity pair and then forced a reserve resynchronization, moving the pool price before trading against it. A separate case drained roughly 32,000 Tether from a position manager contract that priced vault shares off a live spot pool, allowing an attacker to inflate share value before redeeming.