Aave founder Stani Kulechov confirmed that the Aave v3 protocol remains secure following an exploit involving a third-party adapter. The incident resulted in the loss of approximately $305 000 from two Safe multisig wallets that utilized an external module built on top of the lending platform.
According to the security firm SlowMist, the vulnerability existed within the FlashLoopAdapter contract. The attacker exploited an access-control flaw, which enabled a fraudulent Safe contract to bypass the authorization checks of the adapter. This allowed the perpetrator to manipulate transaction data and router settings.
The attacker executed transactions to repay about 1 300 wrapped Ether in debt, which unlocked the collateral held in the victim wallets. Ultimately, the exploit drained 114.09 Ether, valued at roughly $305 000. SlowMist confirmed that the Aave v3 core contracts were not impacted by the breach.
