FlashLoopAdapter Exploit Drains $305K from Aave Linked Safe Wallets

A vulnerability in the FlashLoopAdapter contract has been exploited by an attacker, draining around $305,000 from two Safe wallets on Ethereum.

The attack was made possible due to a weakness in the access controls used by the adapter's open() and close() functions. Instead of independently verifying the caller's identity, these functions checked whether ISafe(msg.sender).isModuleEnabled(address(this)) returned true. An attacker could deploy a fake Safe contract that would return true, allowing them to bypass authentication checks.

The attacker took advantage of this vulnerability to repay 1,335 WETH in Aave debt and withdraw approximately 1,306 weETH in collateral from one of the affected wallets. The second wallet lost around 6.4 weETH through the same vulnerable module.

Aave founder Stani Kulechov stated that the affected contract was a third-party external adapter built on top of Aave and had 'zero effect' on Aave v3.