Aave's FlashLoopAdapter Exploited for $300,000 Loss

Aave's FlashLoopAdapter was exploited by an attacker, resulting in the loss of approximately 114 ETH, valued at over $300,000. The security firm SlowMist investigated and found that the issue lay with a third-party tool built on Aave.

The vulnerability was due to authentication checks being bypassed, allowing the attacker to withdraw collateral from affected Safe multisig wallets. This occurred because the open and close functions in the adapter could be forged by creating a fake Safe contract that always returned a positive response when asked about module activation.

The attack also involved using the execTransactionFromModule function, which allowed transactions to be executed through the victims' Safes. The attacker was able to withdraw weETH and collateral tied to positions on Aave, as well as repay 1,300 WETH in debt to unlock the collateral linked to these positions.

Aave founder Stani Kulechov stated that this incident did not involve the Aave v3 contract, and there was 'zero effect on Aave v3.'