Third-Party Adapter Exploit Drains $305k from Two Safe Multisig Wallets

An attacker exploited an access-control flaw in a third-party adapter built on Aave v3 to drain about $305,000 from two Safe multisig wallets. The FlashLoopAdapter, used to open and close leveraged Aave v3 positions through Safe wallets, was compromised.

The attack bypassed the authentication check by creating a fake Safe contract that always returned a positive response when asked whether the module was enabled. This allowed the attacker to execute transactions through the victims' Safes and withdraw collateral associated with their Aave positions.

Aave founder Stani Kulechov confirmed that the incident involved external infrastructure built on top of Aave, not the protocol itself. The affected code was part of a third-party adapter, not Aave v3's core contracts.