preferred on
Points of Focus
- An access-control flaw in a custom FlashLoopAdapter resulted in an estimated 114.09-ETH, or roughly $305,000, loss from two safe wallets.
- The vulnerable adapter was built on top of Aave; available evidence shows Aave v3 itself was not compromised.
- The attack follows the Near Intents and Bitget incidents, extending a recent pattern of losses originating outside protocols’ core contracts.
A custom module used to manage leveraged positions on Aave v3 has been exploited for 114.09 Ether (ETH), adding another incident to a recent run of crypto attacks targeting infrastructure surrounding otherwise functioning protocols.
SlowMist identified the vulnerable component as FlashLoopAdapter, a safe module designed to open and close leveraged Aave v3 positions. The attacker exploited weaknesses in its access-control logic rather than breaking Aave’s lending contracts.
The distinction matters: This was an Aave-linked exploit, not an exploit of Aave v3 itself.
Fake safe was enough to pass authentication
The vulnerability centered on how FlashLoopAdapter’s “open()” and “close()” functions authenticated callers.
According to Defimon Alerts, the adapter trusted a caller if it responded that the module was enabled. An attacker could therefore create a fake safe contract that returned the expected response and passed the check. The adapter’s swap functionality also allowed caller-controlled routing instructions.
The attacker then pointed that functionality toward legitimate victim safes and invoked “execTransactionFromModule().” Because FlashLoopAdapter was already an authorized module, the victim safe executed the transaction.
A Morpho Wrapped Ether (WETH) flash loan was used to repay 1,335 WETH of Aave debt belonging to the larger affected position. That unlocked 1,306 weETH in collateral, which could then be withdrawn. Another 6.4 weETH was taken from a second Safe.
After settling the borrowed liquidity and swaps, the attacker retained 114.1 ETH, valued at around $305,000. Both affected safes reportedly had the same single owner.
The victims have since offered a 10% white-hat bounty, allowing the attacker to retain 11.41 ETH if 102.69 ETH is returned by Oct. 3.
Aave’s core contracts were not the failure point
Calling this simply an “Aave hack” risks obscuring where the vulnerability actually existed.
FlashLoopAdapter was a custom third-party contract layered on Aave v3. Aave founder Stani Kulechov said the affected adapter was not part of the core protocol and had zero impact on Aave v3. The security analysis currently supports that distinction.
Aave’s own architecture uses dedicated access-control infrastructure for protocol-level roles and permissions.
The incident instead demonstrates how additional automation can expand the security perimeter. A safe may remain secure, and Aave’s contracts may operate correctly, yet a module granted permission to execute transactions can still become an indirect route into assets.
Bitget, Near Intents, and Aave show three different weak links
That pattern has become increasingly visible.
Bitget lost $387.5 million after an attacker exploited a vulnerability in a third-party security product, obtained high-level credentials, and submitted fraudulent withdrawal commands. Private keys and cold wallets were not compromised, according to the exchange’s findings summarized by SlowMist.
Near Intents then suffered $3.8 million in suspicious outflows from its BNB Smart Chain hot-wallet infrastructure despite its core cross-chain contracts not being identified as the compromised component.
Now FlashLoopAdapter adds another variation: weak authentication inside a permissioned module.
The losses differ enormously, and there is no evidence connecting the attackers. But technically, they illustrate the same broader problem.
Crypto security is increasingly determined not only by whether the core protocol has secure code but by every wallet, module, credential system, and third-party component trusted to interact with it.
Share
Most read articles
