Third-party Aave adapter exploit drains 114 ETH from Safes

An attacker drained about 114.09 ETH — worth roughly $305,000 — from two Safe multisig wallets on Oct. 2 by exploiting an access-control flaw in a third-party adapter built on Aave v3, according to Cryptoslate. Blockchain security firm SlowMist traced the loss to the FlashLoopAdapter, a module used to open and close leveraged Aave v3 positions through Safe wallets, while Aave’s own contracts were untouched.

Kulechov addressed the distinction directly, saying the affected code was not part of the protocol’s base layer. Cryptoslate reported him as saying the incident involved a third-party external adapter built on top of Aave rather than an Aave v3 contract, with no effect on the v3 codebase. For the largest decentralized lending protocol, which the report said holds more than $33 billion in total value locked, that separation is the central fact of the story.

The authentication bypass at the centre of the exploit

SlowMist attributed the vulnerability to the adapter’s open() and close() functions, which verified whether the calling Safe had enabled the adapter as a module. That check could be spoofed. The attacker created a fake Safe contract that always returned a positive response when asked whether the module was enabled, and the adapter accepted the forged authentication before proceeding to its internal swap function.

The more serious weakness followed. The adapter allowed the caller to specify both the router and the calldata used in an external contract call. According to SlowMist, the attacker pointed the router back at the victim Safe and supplied instructions invoking Safe’s execTransactionFromModule function. Because the FlashLoopAdapter was already enabled as a module on the affected wallets, that path let the attacker execute transactions through the victims’ Safes and withdraw the collateral.

Both outlets reported the same loss figure. Cointelegraph, which also covered the incident, said SlowMist’s estimate of about 114.09 ETH equated to roughly $305,000. The two reports are consistent on the amount, the number of wallets, and the adapter at fault. Cointelegraph additionally noted that SlowMist identified the vulnerable FlashLoopAdapter contract and the attacker’s wallet, and that the security firm did not report any losses to Aave v3 itself.

Why it matters

The incident is a reminder that in decentralized finance, a protocol can remain secure on its own terms while the integrations layered around it open separate attack surfaces. Users of the FlashLoopAdapter carry that exposure, not Aave’s base contracts. The pattern has become familiar: an audited core protocol, an unaudited or lightly reviewed peripheral module, and a configuration mistake that turns a convenience tool into an entry point. For borrowers who rely on third-party position managers, the loss was real regardless of where the code lived on the stack.

What to watch

The immediate question is how widely the vulnerable module was deployed — specifically, whether other wallets enabled the same adapter and whether its developers can identify additional affected positions before attackers reuse the authentication flaw. SlowMist’s disclosure named the vulnerable contract and the attacker’s wallet, which gives other integrators a starting point for checking their own exposure.

Sources: CryptoSlate, Cointelegraph