Aave Loop Module Flaw Allows 114 ETH Theft from Safe Multisigs

A security vulnerability in Aave's v3 protocol allowed an attacker to drain around 114.09 ETH from two Safe multisig wallets. The flaw, which has been dubbed the 'FlashLoopAdapter' issue, was discovered by the security firm SlowMist and allowed an attacker to bypass access controls on an external helper contract.

The vulnerability was triggered when the attacker used a forged Safe contract to trick the FlashLoopAdapter's open() and close() functions, allowing them to execute transactions without the need for a full signing quorum. The attacker then used the stolen funds to repay a debt of around 1,300 WETH, leaving them with a profit of 114.09 ETH.

Aave's core pools and the Safe core were left untouched, but the vulnerability highlights the importance of security in the DeFi space. Anyone running a Safe should review their module list and switch off any unnecessary modules to prevent similar attacks in the future.