GoPlus: A vault contract on the Base chain was attacked, with losses of about $6 million, and about $31.7 million in assets still at risk

Foresight_News · 2026-10-05T01:13:02.000Z

According to Foresight News, a message from the GoPlus security team disclosed that a vault contract on the Base chain, which has not been publicly claimed by the project team, was attacked. The attacker used a Safe multisig to add a malicious contract to the lending whitelist, then extracted 1,783 aBaswstETH and redeemed about 1,783 wstETH on Aave V3, resulting in losses of approximately $6 million. The attack stemmed from a failure in multisig governance and access control. For 25 days before the project team was attacked, they did not execute a Safe transaction for the vault contract, which may have left the vault vulnerable to social engineering attacks or internal collusion. The core Aave contracts and the Base chain itself were not affected. As of the time of writing, about $31.7 million worth of assets in the attacked vault remains at risk.

Foresight News 消息，据 GoPlus 安全团队披露，Base 链上一个未被项目方公开认领的金库合约遭攻击，攻击者通过 Safe 多签将恶意合约加入借贷白名单，提取 1783 枚 aBaswstETH 并在 Aave V3 赎回约 1783 wstETH，损失约 600 万美元。攻击源于多签治理与访问控制失效，项目团队遭攻击前 25 天未对该财库合约执行 Safe 交易，可能遭社会工程学攻击或内部勾结；Aave 核心合约和 Base 链本身未受影响。截止发稿，遭攻击金库内仍有约 3170 万美元资产处于风险中。