1,783 wstETH. Roughly $6 million. Drained from a Base vault on October 4, in broad daylight, on-chain.
The part nobody is talking about is how normal it all looked. A new contract got added to the vaults whitelist. The multisig did its job: three of seven signers approved the change. Then the attackers contract borrowed aBaswstETH and left. Six clean outflows. The system worked exactly as built.
That is the uncomfortable part. Nothing failed. The access list was changed through the front door, the two changes about a minute apart, and the money started moving roughly 70 seconds later. No timelock between approval and execution, so nobody had a window to notice or stop it.
Aave was not breached. Base was not breached. The vaults own permission system was the vulnerability.
Everyone audits smart contract logic. Almost nobody audits the two questions that keep draining vaults: who is allowed to change the access list, and how fast can they do it.
A multisig with instant execution is not deep security. It is a fast approval pipeline. Timelocks are the boring infrastructure nobody brags about shipping, and they are the thing that would have stopped this.
$ETH #DeFi
The part nobody is talking about is how normal it all looked. A new contract got added to the vaults whitelist. The multisig did its job: three of seven signers approved the change. Then the attackers contract borrowed aBaswstETH and left. Six clean outflows. The system worked exactly as built.
That is the uncomfortable part. Nothing failed. The access list was changed through the front door, the two changes about a minute apart, and the money started moving roughly 70 seconds later. No timelock between approval and execution, so nobody had a window to notice or stop it.
Aave was not breached. Base was not breached. The vaults own permission system was the vulnerability.
Everyone audits smart contract logic. Almost nobody audits the two questions that keep draining vaults: who is allowed to change the access list, and how fast can they do it.
A multisig with instant execution is not deep security. It is a fast approval pipeline. Timelocks are the boring infrastructure nobody brags about shipping, and they are the thing that would have stopped this.
$ETH #DeFi
