On September 15, an unknown attacker targeted a Safe wallet on the Ethereum network, attempting to withdraw approximately 2,900 rsETH tokens valued at $7.73 million. The incident occurred when the attacker used a public Multicall function to redirect a Uniswap v4 liquidity module to a malicious pool.
The MEV bot Yoink detected the transaction and front-ran the attacker, successfully securing the assets within the same block. Security firms BlockSec, SlowMist, and AstraSec identified the root cause as a flawed authorization check in a third-party Multicall contract that the wallet owner had previously granted permissions to.
Researchers confirmed that the vulnerability did not affect the core Safe smart contracts, but rather a custom component connected by the user. The Kelp DAO protocol, which issues rsETH, identified the suspicious activity and imposed a 24-hour freeze on the address that received the tokens.
Kelp DAO stated that the restriction is limited to a single address and does not impact the protocol's smart contracts. The rsETH token remains fully collateralized, and all standard operations, including minting and withdrawals, continue to function normally for other users.
