Aave v3 Loop Module Hacked for 114 ETH via Spoofed Access Control

A security firm called SlowMist flagged an exploited contract that enabled a hacker to steal 114.09 ETH (worth $307,065) from two Safe multisig wallets on October 1, 2026.

The hacked contract was the FlashLoopAdapter, which allowed looping positions on Aave v3. The attacker used this module to siphon funds from the two Safes and also borrowed an additional 11,537 WETH (worth $31 million) in a flash loan from Morpho, repaid within the same transaction.

The vulnerability was due to the adapter's open() and close() access control, which only checks if msg.sender reports the adapter as enabled. A contract that always returns true can pass this check, allowing an attacker to spoof the Safe and steal its funds.