Squid làm rõ vụ khai thác mô-đun bên thứ ba, giao thức lõi không bị ảnh hưởng

The official post from Squid (@squidrouter) and monitoring by the on-chain security platform Blockaid (@blockaid_) revealed that a third-party Gnosis Safe module named "SquidRouterModule" was recently exploited on the Base and Ethereum networks, resulting in the theft of approximately 86 Gnosis Safe wallets and losses of around $3.2 million. The stolen tokens were subsequently exchanged for DAI via Uniswap V3 pools controlled by the attacker. Squid officially clarified that this module was neither developed, deployed, nor operated by them; the name "SquidRouterModule" was merely chosen by a third party during their independent integration with Squid and is unrelated to Squid’s core routing contract (0xce16F69375520ab01377ce7B88f5BA8C48F8D666). The vulnerability stemmed from the third-party module accepting constant strings provided by callers as security credentials, allowing attackers to exploit this flaw and execute arbitrary call data to steal assets from victims’ Safe wallets. Squid users’ funds, authorizations, and integrations remain secure, and the official team will continue monitoring the situation.