FlashLoopAdapter Exploit Saps $305,000 From Aave-Linked Safe Wallets

How the FlashLoopAdapter Breach Unfolded

A recently discovered vulnerability in a custom FlashLoopAdapter allowed an attacker to drain more than $300,000 from two Safe wallets that were managing leveraged positions on Aave v3. The breach occurred over the past week on the Ethereum mainnet, targeting users who rely on the adapter to automate flash loan strategies. The incident highlights the risks of third‑party modules that lack robust access controls.

The FlashLoopAdapter is a popular tool among DeFi traders for orchestrating leveraged Aave v3 positions via flash loans. However, a flaw in its permission system let an unauthorized actor execute malicious calls. The attacker exploited the adapter’s ability to bypass the Safe’s module whitelist, injecting a forged transaction that siphoned assets into a different address. The loss, estimated at $305,000, was split between two separate wallets that had been using the adapter to manage their positions.

Security researchers traced the attack to a single transaction that exploited the adapter’s „execute” function. The function, designed to run arbitrary calls, did not verify the caller’s identity against the Safe’s approved modules. An attacker crafted a payload that impersonated the adapter, then executed a series of swaps and withdrawals that drained the leveraged positions. The transaction was confirmed within minutes, and the stolen funds were quickly moved to a cold wallet outside the network’s monitoring scope.

What Does This Mean for DeFi Users?

A security analyst noted, „The core issue is a missing access‑control check. Once the attacker had the ability to call the adapter, the rest of the Safe’s safeguards became irrelevant.” The adapter’s code did not enforce the Safe’s module approval list, a standard practice in Safe contracts. As a result, the attacker could bypass the Safe’s own permission system entirely.

The incident raises questions about the safety of third‑party modules in the DeFi ecosystem. Users who depend on automated strategies may unknowingly expose their funds to similar vulnerabilities. The incident underscores the importance of auditing custom adapters before deployment, and of regularly reviewing the modules that a Safe allows to interact with it. While the two affected wallets were relatively small compared to the overall market, the loss demonstrates that even modestly sized positions can be targeted.

The broader DeFi community is responding with calls for stricter standards around module permissions. Some projects are now implementing stricter checks that require explicit approval for each function call. Others are moving toward self‑service permission models, where users must manually approve every transaction. The incident may also accelerate the adoption of hardware wallet integration and multi‑signature requirements for leveraged positions.

The immediate consequence is a loss of confidence among users of the FlashLoopAdapter. The developers behind the adapter have issued a statement promising a comprehensive audit and a patch that will enforce strict access controls. Meanwhile, the two wallets that suffered the loss are working with the Safe team to recover the stolen funds, though the success of recovery remains uncertain.

Frequently Asked Questions

Q1: Can the stolen funds be recovered? A1: The Safe team is investigating the transaction trail and may be able to reverse the transfer if the funds remain in a recoverable state. However, if the attacker moved the assets to a cold wallet, recovery is unlikely.

Q2: Are other Safe wallets at risk? A2: Any wallet that has installed the same FlashLoopAdapter without proper access controls could be vulnerable. Users should audit their modules and consider disabling or updating the adapter.

Q3: What steps can users take to protect themselves? A3: Users should review the permissions granted to each module, limit the number of active modules, and consider using hardware wallets or multi‑signature setups for high‑value positions.