Access-Control Vulnerability Exploited in FlashLoopAdapter

The incident involved the FlashLoopAdapter, a component of the Aave V3 Loop Safe Module. An attacker exploited an access-control vulnerability by spoofing Safe authentication, which allowed them to bypass the module's authorization check. By manipulating the swapRouter and swapCalldata, the attacker executed unauthorized transactions targeting the victim Safes using the execTransactionFromModule() function.

To facilitate the attack, the perpetrator utilized a Morpho WETH flash loan to repay the affected Safe’s Aave V3 debt. This action unlocked the collateral held within the Safes, enabling the attacker to drain weETH from two Safes. The total loss incurred from this incident was approximately 114.09 ETH, valued at around $305,000.

The incident occurred on the Ethereum chain, which allows for tracking of the transactions involved. The on-chain record would reflect the unauthorized transactions executed by the attacker, detailing the flow of funds and the addresses involved in the exploit.