An unnamed vault on Base was exploited for about $6 million, according to Gonçalo Magalhães, head of security at Immunefi. He said the vault still held roughly $31.7 million in assets when the incident took place. A briefing cited by Magalhães said the attacker used a Safe multisig wallet to add a malicious contract to the vault’s borrowing whitelist, then withdrew 1,783 aBaswstETH and swapped it through AaveV3 for about 1,783 wstETH. Magalhães said the design appeared safe on the surface because it restricted access to whitelisted addresses, but any approved address could remove assets without collateral, creating the vulnerability. He also said the weakness in the whitelist logic had been identified the week before, though researchers did not have a clear disclosure channel at the time. More than 24 hours after the incident, no team had publicly claimed responsibility for the vault or disclosed any remediation steps.
According to ChainCatcher, an unnamed vault on Base was exploited for about $6 million, Immunefi head of security Gonçalo Magalhães said. The vault still held roughly $31.7 million in assets when the incident happened.
Based on a briefing cited by Magalhães, the attacker used a Safe multisig wallet to add a malicious contract to the vault’s borrowing whitelist. The attacker then withdrew 1,783 aBaswstETH and converted it through AaveV3 into about 1,783 wstETH.
Magalhães said restricting access to whitelisted addresses may look safe at first glance, but once an address is approved, it can remove assets without posting collateral, which created the vulnerability. He added that the whitelist weakness had already been identified the previous week, but researchers lacked a clear disclosure channel.
More than 24 hours after the exploit, no team had publicly identified itself or disclosed any remedial measures.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
