FlashLoopAdapter漏洞导致安全钱包抵押品被耗尽

SlowMist discloses FlashLoopAdapter vulnerability: Third-party component causes Safe multi-signature wallet funds to be stolen

Blockchain security company SlowMist reported that a third-party component called FlashLoopAdapter had a vulnerability that was used by attackers to drain collateral assets from two Safe Multisign wallets. This incident has once again raised concerns about the risks "external adapters" pose to the originally rugged hosting architecture.

Report details on FlashLoopAdapter flaws

According to SlowMist, the attack originated from the FlashLoopAdapter. This is a third-party module integrated with Safe Multi-Signature Wallet, not a security vulnerability of the Safe protocol itself. SlowMist attributed the theft of mortgage assets directly to flaws in the adapter rather than problems with Safe's core contract. This distinction is crucial because Safe is a widely used multi-signature framework, and confusing adapters with core protocols can distort the scope of the incident.

The report follows a pattern previously documented by SlowMist. In a previous alert about Aave v3 Loop Safe Module explosions involving 114.09 ETH, the company pointed out that the loop-based lightning loan strategy integrated through Safe modules may expose users 'mortgage assets to attack. FlashLoopAdapter events seem to fall into the same type of adapter-level risk category.

How two Safe multi-signature wallets lose collateralized assets

The attacker targeted two separate Safe multi-signature wallets and drained the mortgaged assets from both. Safe multi-signature wallets require multiple private key signatures to authorize transactions and are a common choice for DeFi users and DAOs seeking greater security than single-key wallets. However, this incident shows that even if the multi-signature structure itself exists, it cannot protect it from attacks through authorized but vulnerable modules or adapters.

In existing reports, SlowMist has not disclosed the specific number of tokens lost, transaction hashes or identity information of wallet holders. Due to the lack of confirmation of on-chain data, the amount of the loss is not evaluated in this article. Readers who need to verify on-chain data should pay attention to SlowMist's official disclosures and cross-check any transaction statements through Etherscan after full details are released.

The importance of this incident to Safe Wallet users

The core lesson lies in "dependency risk". The strength of Safe Wallet's security model depends only on the security of the authorized modules and adapters it interacts with. If a third-party adapter is introduced that has not been strictly audited, it will increase the attack surface even if there are no problems with the underlying Safe contract.

Such module-level attacks are not theoretical assumptions. The Aave v3 Loop Safe Module case previously flagged by SlowMist involved 114.09 ETH, proving that when the adapter logic is defective, the loop policy executed through the Safe module can be manipulated. The FlashLoopAdapter event shows that this pattern has been reproduced through different adapters for the same architectural weaknesses.

Key Points

• Third-party adapters have independent risks: If additional modules are not individually audited, it is not enough to review the Safe protocol.
• Affected scope: Two wallets were affected. The incident was not limited to a single user, indicating that any Safe wallet authorized with a FlashLoopAdapter may have exploitable flaws.
• Awaiting for full disclosure from SlowMist: At the time of publication, specific loss figures and transaction details had not been independently verified. Before reaching conclusions, please rely on SlowMist's official post-mortem analysis report.

The full scale of the FlashLoopAdapter attack remains unconfirmed until SlowMist releases a full incident report containing transaction-level evidence. Safe Wallet users who have authorized any Lightning Loan or Loop Adapter should review their module permissions and consult SlowMist for advice on remediation guidance.