Aave V3 Loop Safe Module Loses Approximately 114.09 ETH Due to Access Control Vulnerability

Techub News reports that the security agency SlowMist has issued a security alert stating that the Aave V3 Loop Safe Module was attacked due to an access control vulnerability, resulting in a loss of approximately 114.09 ETH. The attacker bypassed the permissions check of the FlashLoopAdapter using a forged Safe contract and used the victim's Safe multi-signature wallet as a router to execute arbitrary module transactions, ultimately stealing funds and repaying approximately 1300 WETH debt to unlock collateral. The attacker's address is 0x42c2633438609881c8fBAb82414eb9A0c45F9353, and the two victim addresses are 0xe3b23e47df7cd85876ac6cb05bdb9d7cd5b28520 and 0xcfedf95a3653a128dfc2e4288758a1a1850d169f. The vulnerability contract address is 0x16bb8b912da187870c23ec6756bb3fad061283d8. (@SlowMist_Team)