A hack on a third-party Aave adapter resulted in a loss of 114 ETH. The incident raises concerns about DeFi security beyond core protocols.
A significant ethereum-validator-exits/">security breach in the decentralized finance (DeFi) space occurred recently when hackers exploited a third-party lending adapter associated with Aave, leading to the theft of approximately 114 ETH, equivalent to over $300,000. Interestingly, the core protocol of Aave itself remained unaffected by this incident.
The blockchain security firm SlowMist published details on October 2, revealing that the perpetrator compromised two Safe multisig wallets via a flaw in the FlashLoopAdapter, which is utilized with Aave v3 positions. By exploiting vulnerabilities in the adapter, the attacker was able to bypass authentication checks, execute arbitrary operations, and essentially drain collateral from the affected wallets.
SlowMist estimated the direct financial loss caused by the exploit to be about 114.09 ETH. Additionally, the attacker apparently repaid a debt of roughly 1,300 WETH during the incident, which allowed them to unlock collateral associated with the targeted positions.
Aave's founder, Stani Kulechov, emphasized that the incident did not involve the core contracts of Aave v3, stating: "This is not Aave v3 contract, it’s a third party external adapter built on top of Aave, zero effect on Aave v3." This distinction is crucial for Aave, which is regarded as the leading decentralized lending protocol, with more than $33 billion locked in total value.
The exploit focused on infrastructure layered atop Aave, signifying that while Aave’s protocol security remains intact, the risks associated with third-party integrations can often lead to vulnerabilities.
According to SlowMist, the vulnerability was traced back to the FlashLoopAdapter’s open() and close() functions, designed to verify whether the calling Safe multisig wallet had enabled the adapter as a module. In an audacious move, the hacker created a fake Safe contract programmed to always respond positively to inquiries about whether the module was activated.
This manipulation enabled the adapter to accept forged authentication leading to unauthorized access. Following this, the attacker was able to direct the router and calldata to an external contract, ultimately pointing back at the victim’s Safe. By supplying specific instructions invoking the Safe's execTransactionFromModule function, the attacker was able to execute transactions using the victims' wallets.
Ultimately, SlowMist stated that this technique was effectively used to withdraw weETH and collateral linked to Aave positions from the two compromised multisig wallets.
This incident accentuates a recurring theme in the world of decentralized finance: while the primary protocol may retain its integrity, integrations and third-party tools can create additional attack surfaces that hackers may exploit. Aave’s core protocol has not shown any vulnerability, but the ecosystem’s periphery continues to pose security challenges as illustrated by this breach.
Aave’s immediate concern appears to be limited to users of the compromised adapter. Still, a pressing question remains: are there other wallets that also enabled the same module? Will the developers of the adapter uncover other vulnerabilities connected to their application before malicious actors can repeat the attack?
Despite the exploit, Aave has maintained a relatively stable presence in the market, even posting a slight increase of 3.64% in the last 24 hours. Currently, Aave holds a rank of #36 based on market capitalization.
This incident also draws attention to a larger trend: as DeFi protocols expand and intertwine with numerous third-party tools, the attack vectors multiply. Users and developers alike must remain vigilant to minimize risks associated with decentralization by adopting more robust security measures and frameworks.
As the DeFi landscape evolves, addressing the security challenges posed by third-party integrations will be crucial in preserving user trust and securing valuable assets.