FlashLoopAdapter Exploit Drains 114 ETH From Aave Users

A third-party lending adapter built on Aave v3 was exploited to steal approximately 114.09 ETH, worth over $300,000, according to a disclosure by blockchain security firm SlowMist on October 2. The attack targeted two Safe multisig wallets but left Aave’s core protocol untouched.

The vulnerable module, called FlashLoopAdapter, allowed an attacker to spoof authentication checks and execute unauthorized transactions. The adapter’s open() and close() functions verified whether a calling Safe had enabled it as a module. The attacker created a fake Safe contract that returned positive responses to these verification queries, bypassing the security layer.

With authentication spoofed, the attacker exploited the adapter’s design flaw: it allowed callers to specify both a router address and calldata for external contract calls. The attacker pointed the router at victim Safe wallets and invoked execTransactionFromModule to execute unauthorized transactions. The exploit targeted weETH and collateral tied to Aave positions.

During the attack, the attacker repaid 1,300 WETH in debt to unlock additional collateral, according to SlowMist’s analysis.

Core Protocol Unaffected

Stani Kulechov, Aave founder, clarified the scope of the incident. “This is not Aave v3 contract, it’s third party external adapter built on top of Aave, zero effect on Aave v3,” he said. Aave’s core smart contracts were not compromised. The protocol, which secures $33 billion in total value locked, remained fully operational.

The incident underscores a persistent risk in decentralized finance: third-party modules and adapters built atop major protocols can introduce vulnerabilities that do not reflect flaws in the underlying infrastructure. FlashLoopAdapter’s developers were not identified in the disclosure.

SlowMist did not name the attacker. The exact date the exploit occurred was not specified; only the disclosure date of October 2 was confirmed. It remains unclear whether additional wallets enabled the vulnerable module or whether further exploits have taken place.