FlashLoopAdapter exploit: self-vouching Safe module

Loss $305K per Defimon; 114.096 WETH (about $305K) per Olympix. Aave v3 contracts not affected (per SlowMist, via Olympix).

Root cause: Per Defimon and Olympix (citing SlowMist): open()/close() authenticated callers only via ISafe(msg.sender).isModuleEnabled(address(this)), which any contract can answer true; _swap() then made a raw call to a caller-supplied target and calldata, pointed at a victim Safe's execTransactionFromModule.

Timeline, as sourced: 1 Oct 2026, exploit tx at 15:08:47 UTC in block 26,098,264 (per Olympix).

On 1 October 2026, two Safe multisigs that had enabled FlashLoopAdapter, a third-party Safe module for Aave v3 leveraged loops, lost collateral on Ethereum. Defimon's alert (opens in a new tab) put the loss at about $305,000 and classed it as an access-control failure. Olympix's write-up (opens in a new tab), citing SlowMist, says the module's open() and close() functions authenticated callers only by asking msg.sender whether the adapter was enabled as its module, which any contract can answer true. A second flaw let the caller choose the target and calldata of a raw swap call, so the attacker aimed it at a victim Safe's execTransactionFromModule. Olympix reports a net of 114.096 WETH to the attacker and says Aave v3's own contracts were not affected.