2026-10-01 · record inc_0011 · updated 2026-10-19
FlashLoopAdapter: a spoofable caller check in a Safe module
A fake Safe let an attacker drive a third-party Aave adapter into emptying two real Safe wallets of about 114 ETH.
FlashLoopAdapter
EthereumComponent: Safe module for leveraged Aave v3 positions
Event: Confirmed on-chainRoot cause: Independent analysisLoss: Independent analysis
This record is not indexed by search engines: it does not yet have a root cause confirmed from a primary source.
Current status
No project statement found.
Timeline
- 2026-10-01 15:08:47 UTCExploit transaction confirmed on Ethereum.
Root cause
Verichains and SlowMist describe a caller check that asked the caller whether the module was enabled, plus a caller-controlled call target and data.
Basis: independent analysis · verified by us against that source
Classes: Access control and caller trust, Flash-loan amplification
Impact: loss and recovery
Two Safe wallets that had enabled the module. Aave v3 and Safe core contracts were not at fault.
Reported loss
$305K (114.09 ETH)
USD basis: Verichains and SlowMist, about 114.09 ETH.
Recovered or returned
Unknown
No report found.
Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.
Addresses and transactions
Contracts and wallets
- 0x16bb8b…1283d8contractEtherscan ↗
FlashLoopAdapter (affected)
Ethereum · victim · Confirmed on-chain · contract code present at the address (read-only)
Transactions
- 0x75328f…616fc4txEtherscan ↗
attack · block 26,098,264 · 2026-10-01 15:08:47 UTC
Confirmed on-chain · read-only JSON-RPC lookup of the transaction and its block · checked 2026-10-19
Explorer links use the chain we confirmed for each item. Where no explorer is configured, or a chain is not verified, we say so rather than guess.
Associated code
- src/test/2026-10/FlashLoopAdapter_exp.solShown in full
Public PoC metadata
- Status
- Test or reproduction identified
- Dataset
- SunWeb3Sec/DeFiHackLabs
- Stored commit
- 7363f76db51f0fea97f8e659b20ee8bdc5fbca25
- Directory / file
- src/test/2026-10/FlashLoopAdapter_exp.sol
- Framework
- Foundry
- Licence
- file UNLICENSED; repository Apache-2.0
- Seen at pin
- yes · retrieved 2026-10-19
- Repository claim
- 114.096151 WETH (~$305k, exactly reproduced) on Ethereum; two Safes that enabled the module as a victim were emptied - Safe #1 lost 1306.48 weETH of Aave collateral once its 1335.26 WETH debt was repaid, Safe #2 lost 6.426 weETH, all swappe
- Note
- Reproduction metadata only. ThreatWire has not run it and does not treat a repository entry as proof that anything is exploitable.
Remediation and defensive indicators
No fix or remediation has been published by the project that we could verify.
Defensive lessons from the class
- Authenticate against addresses you control, never against the caller's own answer.
- Validate forwarded senders cryptographically.
- Do not treat a single-block price as truth.
- Assume any bug that needs capital can be funded for free.
Sources
Independent analysis
Verichains: FlashLoopAdapter exploit analysis
Published 2026-10-12 · retrieved 2026-10-19
Independent analysis
SlowMist: Alert on FlashLoopAdapter
retrieved 2026-10-19
Independent analysis
PublicAML: Access-control vulnerability exploited in FlashLoopAdapter
retrieved 2026-10-19
Media report
CryptoSlate: Third-party Aave tool exploit, Aave founder statement
retrieved 2026-10-19
- UNCX Vesting V2: share records and token balance made to disagreeShared class: Flash-loan amplification
- MakerDAO flip keeper: an unprotected function handed an attacker control of dormant auction winningsShared class: Access control and caller trust
Read the full written analysis
Method, uncertainty and corrections
Still unknown
- Attacker identity
- Developer response
Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.
No corrections recorded since publication.