BTC $85,704 
ETH $2,710 
USDT $0.9998 
BNB $775.51 
XRP $1.51 
USDC $0.9999 
SOL $120.65 
TRX $0.3349 
FIGR_HELOC $1.01 
ZEC $1,373 FlashLoopAdapter flaw drains $305K from two Safe wallets
An attacker passed a fake Safe through a third-party Aave module's access checks and drained two Ethereum wallets.
Key takeaways
- Loss estimates differ. Defimon Alerts put the loss at about $305,000, while SlowMist estimated about $310,000 and 114.09 ETH.
- Two wallets drained. One Safe lost about 1,306.48 weETH and a second lost about 6.4 weETH in the same incident.
- Debt repaid first. The attacker used a Morpho flash loan to repay about 1,335 WETH of Aave debt before withdrawing collateral.
What happened
An access control flaw in FlashLoopAdapter, a custom Safe module used to manage leveraged Aave v3 positions, was exploited on Ethereum on Oct. 1. Defimon Alerts, which detected the attack at 15:08:57 UTC, estimated the loss at about $305,000 across two Safe wallets.
The attacker borrowed WETH from Morpho and used the flash loan to repay about 1,335 WETH of Aave debt held by the first Safe. That freed the collateral, and about 1,306.48 weETH was withdrawn. A second Safe wallet lost about 6.4 weETH in the same incident.
SlowMist said the attacker exploited an authentication flaw in the FlashLoopAdapter contract. The weakness was in the access controls of the adapter's open() and close() functions, which used a check that a fake Safe contract could answer as true.
Another function, _swap(), allowed a raw call to a swap router using data supplied by the caller. The attacker set that router to one of the victim Safe wallets and set the data to call execTransactionFromModule, a Safe function that lets an enabled module run a transaction.
The attacker retained around 114.09 ETH after using the module to manipulate the affected positions. SlowMist put the incident at about $310,000 and 114.09 ETH.
Why it matters
Aave founder Stani Kulechov said the affected contract was a third party adapter built on Aave and had zero effect on Aave v3. Defimon Alerts said Aave v3 itself was not affected.
FlashLoopAdapter was designed as a Safe module for opening and closing leveraged positions through Aave v3. The loss sits with wallets that enabled a custom module, not with the lending pool's core code.
A similar problem involving permissions attached to Safe modules surfaced in September. An Ethereum Safe wallet exploit involving roughly 2,900 rsETH was traced by BlockSec to weak authorization checks in an executor contract connected to an enabled Safe module.
What the data shows
Etherscan listed the gross value of one transaction at about $3.88 million. That figure reflects the total collateral moved, not the final loss.
Defimon Alerts put the loss at about $305,000, while SlowMist estimated about $310,000 and 114.09 ETH.
Background
On September 15, a separate Safe wallet holding a leveraged Aave V3 position was drained of about 2,900 rsETH, worth around $7.8 million at the time. That attacker used a Uniswap V4 hook to convert the position into transferable rsETH. A bot called Yoink front-ran the attacker's own transaction and took the funds instead, and Kelp DAO paused the receiving address.
What is still unclear
- The two publishers give different loss estimates: Defimon Alerts cited about $305,000, and SlowMist cited about $310,000 and 114.09 ETH.
- SlowMist attributes the flaw to the adapter's authentication check, while Defimon Alerts also noted that checks during the callback did not stop the transaction because the attacker's contract acted as the flash liquidity provider.
Questions readers ask
What is FlashLoopAdapter?
FlashLoopAdapter was designed as a Safe module for opening and closing leveraged positions through Aave v3. Safes that enabled the module could use it to manage looping strategies involving borrowed assets and collateral.
Was Aave v3 affected by the exploit?
No. Aave founder Stani Kulechov said the affected contract was a third party adapter built on Aave and had zero effect on Aave v3. Defimon Alerts said Aave v3 itself was not affected.
How much was lost in the FlashLoopAdapter exploit?
Defimon Alerts estimated the loss at about $305,000 across two Safe wallets. SlowMist gave a loss estimate of about $310,000 and 114.09 ETH.
How did the attacker get past the module's checks?
SlowMist said the attacker exploited an authentication flaw in the FlashLoopAdapter contract. The attacker deployed a fake Safe contract programmed to return true when the adapter made its check.
Sources · 6 publishers
-
FlashLoopAdapter exploit drains $305K from Aave linked Safe wallets -
Two Safe Wallets Lose $305,000 in FlashLoopAdapter Attack -
Aave-Linked Safe Wallet Module Exploited, Over $300,000 Drained From Two Wallets -
FlashLoopAdapter Exploit Results in $305K Loss from Ethereum Safe Wallets -
Aave-Linked Exploit Drains $305K in ETH From Safe Wallet
-
Aave founder says V3 unaffected after third-party adapter exploit drains $305K
