Root Cause
The vault's access-control model allowed any address on the Safe multisig whitelist to withdraw assets unconditionally. An attacker — through a combination of probable compromised signer keys or social engineering — submitted two Safe transactions within one minute of each other on October 4, 2026:
- 08:52 UTC – Removed attacker-linked contract from whitelist (possibly a cleanup-looking transaction).
- 08:53 UTC – Re-added the same contract with full withdrawal rights.
Both carried valid signatures from existing multisig signers despite no prior owner activity for 25 days.
// Conceptual vault authorisation check (vulnerable)
function withdraw(address to, uint256 amount) external {
require(whitelist[msg.sender], "Not whitelisted");
// No further checks: amount, collateral, or position validation
aToken.redeem(amount, to);
}
Once whitelisted, the attacker drained aBaswstETH across six transactions, then redeemed through Aave V3 for underlying wstETH.
Attack Steps
| Step | Action | Detail |
|---|---|---|
| 1 | Compromise/social-engineer Safe signer(s) | Vault's Safe had not transacted in 25 days |
| 2 | Submit whitelist-remove tx (08:52 UTC) | Attacker contract removed — possibly to avoid detection |
| 3 | Submit whitelist-add tx (08:53 UTC) | Same attacker contract re-added within 60 seconds |
| 4 | Drain 1,783.067 aBaswstETH in 6 txns | Within ~19 minutes of the whitelist change |
| 5 | Redeem via Aave V3 | aTokens exchanged for 1,783 wstETH (~$6M) |
| 6 | Exfiltrate | Funds moved to attacker-controlled wallet |
Impact
- Loss: ~$6M (1,783 wstETH)
- Chain: Base (L2)
- Date: October 4–5, 2026
- Recovery: None reported.
- Residual risk: Approximately $31.7M in additional vault assets was noted as still at risk at time of initial reports.
- Scope: Aave V3 core contracts and Base chain were not compromised; the flaw was in the vault's own Safe-based access controls.
Lessons for Auditors
- Whitelist-based vault withdrawals need secondary constraints: A simple boolean allowlist is insufficient; validate amounts, position limits, and time-locks.
- Multi-sig custody of DeFi positions needs monitoring: Prolonged signer inactivity followed by sudden multi-sig transactions is a red flag for compromise; off-chain monitoring systems (e.g. Forta, Tenderly) should alert on such patterns.
- aToken redemption paths can be weaponised: Any contract that automatically converts aTokens to underlying on a permissioned call is a high-value target if permissioning logic is weak.
- Vault operators should be identified: An "unclaimed" vault holding $30M+ with no public operator reduces incident-response speed and accountability.