FlashLoopAdapter access-control flaw costs two Aave-linked Safe wallets about $305,000

Two Safe wallets linked to Aave v3 lost approximately 114.09 ETH, worth about $305,000, in an exploit involving the FlashLoopAdapter, according to reports citing security firm SlowMist ^{[1] [2] [3]}.

SlowMist attributed the attack to an access-control flaw in the adapter’s open() and close() functions that let the attacker bypass Safe authorization and execute modules. The attacker reportedly repaid about 1,300 WETH in debt to unlock collateral; one report noted that roughly 1,306 weETH withdrawn from a wallet was a gross transaction flow, not the attacker’s net proceeds ^{[1] [3] [4]}.