Aave v3 remains unaffected after third-party adapter exploit
Aave v3 hack update: attacker drained $305K via a Safe adapter flaw, not Aave See how the exploit worked and why the protocol itself stayed unaffected
Aave founder Stani Kulechov said the Aave v3 protocol was not impacted after an attacker used a thirdparty adapter to drain about $305,000 from two Safe multisig wallets.
According to blockchain security firm SlowMist, the attack targeted a module used to open and close leveraged Aave v3 positions through Safe wallets. The exploit took advantage of an accesscontrol flaw that let a fake Safe contract pass the adapter’s authorization check.
SlowMist said the vulnerable FlashLoopAdapter contract also allowed the attacker to influence the router and swap transaction data, which helped them execute transactions through the victim wallets and drain weETH and collateral. The firm identified the attacker’s wallet and the vulnerable contract, while saying there were no losses to Aave v3 itself.