🚨 FlashLoopAdapter (Aave v3 loop Safe module) - Loss $305K (2026-10-01)

Network: Ethereum
Type: Access Control

FlashLoopAdapter is a Safe module that opens/closes Aave v3 leveraged loops for the Safes that enable it. open()/close() trust any msg.sender that answers isModuleEnabled() = true, so a fake "Safe" passes. The callback's own checks pass because the attacker's contract is the flash provider too. _swap() then makes a raw call to the caller-supplied swapRouter with any swapCalldata.

The attacker set swapRouter to a victim Safe and swapCalldata to execTransactionFromModule(...). The call came from the enabled module, so the Safe ran it. Using a Morpho WETH flash loan, the attacker repaid Safe 0xcfed…'s 1,335 WETH Aave debt, then had the Safe withdraw 1,306 weETH of collateral to the attacker. They also pulled 6.4 weETH from a second Safe (0xe3b2…), swapped to WETH and kept 114.1 ETH. Both Safes have the same single owner. The adapter is a custom contract built on top of Aave. Aave v3 itself is not affected.

TX: https://etherscan.io/tx/0x75328f916b1a0878724d364da5eb12b255160b894cb36c63ed5d718efc616fc4
Attacker: https://etherscan.io/address/0x42c2633438609881c8fbab82414eb9a0c45f9353
Vulnerable module: https://etherscan.io/address/0x16bb8b912da187870c23ec6756bb3fad061283d8
Victim #1: https://etherscan.io/address/0xcfedf95a3653a128dfc2e4288758a1a1850d169f
Victim #2: https://etherscan.io/address/0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520

⚡️ Detected at 15:08:57 UTC
⏱️ Real-time alerts: @defimon_subscription_bot