The Base vault’s Safe removed the attacker-controlled contract from the whitelist at 08:52 UTC on October 4 and admitted it again at 08:53 UTC.

verified span

“At 08:52 UTC the Safe wallet of the vault owner removed a contract belonging to the attacker from the whitelist. One minute later, at 08:53 UTC, the same contract was admitted again.”