Base Vault Loses $6 Million in Aave Tokens After Whitelist Change
A vault on the Base network experienced a significant loss of approximately $6 million after six separate outflows of Aave deposit tokens. The incident occurred following a change to the vault’s borrower whitelist, which allowed unauthorized access to the funds. The withdrawn tokens were subsequently converted into wrapped staked Ether (wstETH), and some of the proceeds were moved toward Ethereum via bridge withdrawals.
Aave deposit tokens are assets deposited through the Aave lending protocol. In this case, the tokens exited the vault in six distinct transactions before being converted to wstETH. The incident underscores the risks associated with modifications to borrower access controls, highlighting the need for robust security measures in decentralized finance (DeFi) platforms.
The movement of funds toward Ethereum suggests that the attackers or withdrawers may have sought to liquidate the assets further. The exact motives behind the outflows remain unclear, but the event serves as a reminder of the vulnerabilities that can arise from changes in access permissions within DeFi ecosystems.