A Three-of-Seven Safe Signed Off on the Contract That Emptied a Base Vault
A Base vault whitelisted one new contract. Forty minutes later, $6 million was gone.
Blockaid flagged the exploit on a Base vault on Oct. 4 at 09:21 UTC.[1] Roughly four transactions had already taken $2.02 million.[2]
The attacker added a new contract to the vault’s whitelist.[3] It borrowed aBaswstETH from it and sent the tokens to its own.[3]
Forty minutes later, about 1,783 wstETH was traced out of the vault, pushing the loss past $6 million.[4]
PeckShield, CertiK and Exvul logged 1,783.067 aBaswstETH redeemed through Aave into about 1,783 wstETH.[5]
GoPlus says the whitelist entry went in through the Safe multisig.[6] Records show that Safe is three-of-seven, about 324 days old, with no signer addresses public.[7]
GoPlus says about $31.7 million is still at risk in the treasury.[8]
What to do: no action needed for Aave or Base users.[9] GoPlus says the core contracts of Aave and Base were not affected.[9]
Who gains, who loses
Receipts
Blockaid spotted what looked like an exploit unfolding on a Base vault at 09:21 UTC on Oct. 4, when about $2.02 million had already drained out.
The attack was still ongoing as of the Blockaid alert, with approximately 4 transactions having resulted in about 2.02 million dollars worth of assets being stolen.
“The attack is still ongoing, and approximately 4 transactions have resulted in about 2.02 million dollars worth of assets being stolen.”
The attacker added a brand new contract to the Base vault's whitelist, then borrowed aBaswstETH from it and transferred it to the attacker's contract, with approximately 4 transactions draining about $2.02 million.
“The attacker added a brand new contract to the vault's whitelist, then borrowed aBaswstETH from it and transferred it to the attacker's contract.”
Roughly 40 minutes after Blockaid's initial alert, security firms traced about 1,783 wstETH taken from the vault, pushing the loss past $6 million.
“Roughly 40 minutes later, security firms traced about 1,783 wstETH taken from the vault, pushing the loss past $6 million.”
Peckshield, Certik and Exvul converged on the same tally: 1,783.067 aBaswstETH was borrowed from the vault and redeemed through Aave into roughly 1,783 wstETH.
According to the GoPlus security team, the attacker added a malicious contract to the lending whitelist through Safe multi-signature and withdrew 1783 aBaswstETH, then redeemed approximately 1783 wstETH on Aave V3, resulting in a loss of about 6 million dollars.
“The attacker added a malicious contract to the lending whitelist through Safe multi-signature and withdrew 1783 aBaswstETH, then redeemed approximately 1783 wstETH on Aave V3, resulting in a loss of about 6 million dollars.”
Onchain records show the drained vault is an Openzeppelin transparent proxy owned by a Safe created about 324 days ago, requiring three of seven signatures to act, with none of its seven signer addresses publicly identified.
“Onchain records show the drained vault is an Openzeppelin transparent proxy owned by a Safe created about 324 days ago.”
As of the time of GoPlus's publication, approximately 31.7 million dollars in assets remain at risk in the attacked treasury.
“As of the time of publication, approximately 31.7 million dollars in assets remain at risk in the attacked treasury.”
The core contracts of Aave and the Base chain itself were not affected by the vault attack.
“the core contracts of Aave and the Base chain itself were not affected.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.