Odaily Planet Daily reports that Gonçalo Magalhães, Head of Security at Immunefi, stated that an unnamed Base vault suffered a vulnerability exploit resulting in approximately $6 million in losses, while the vault still held around $31.7 million in assets at the time of the incident. According to the briefing, the attacker added a malicious contract to the vault’s lending whitelist via a Safe multisig wallet, then withdrew 1,783 aBaswstETH and exchanged them for approximately 1,783 wstETH via Aave V3. Gonçalo Magalhães noted that while whitelist restrictions on addresses appear secure, any approved address can withdraw assets without collateral, creating a vulnerability; this whitelist weakness had been identified the previous week, but researchers lacked a clear disclosure channel. More than 24 hours after the incident, no team has publicly claimed responsibility or disclosed remediation measures.
Unnamed Base Vault Exploited for $6 Million via Malicious Contract
KuCoinFlashShare
Summary
A CFT-related incident affected Base when an unnamed vault was drained of $6 million via a malicious contract. The attacker used a Safe multisig to add the contract to the lending whitelist, then withdrew 1,783 aBaswstETH and converted them to wstETH on AaveV3. Immunefi’s Gonçalo Magalhães stated that the vulnerability allowed whitelisted addresses to withdraw assets without posting collateral. Researchers had flagged the issue a week earlier but lacked a clear disclosure pathway. More than 24 hours later, no team had claimed responsibility or taken steps to mitigate the risk to risk-on assets.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.