1/4
Exploit Overview
On September 15, 2026, a severe authorization bypass within a strategy executor resulted in the draining of a high-net-worth individual's #Safe wallet. This incident led to an approximate loss of $7.8M.
Understanding the Root Cause
The vulnerability was isolated to an unverified strategy executor located at the contract address 0x4f0055926c839D1d960a82CBF84E2eE933958ebC. It is important to emphasize that this flaw was not found in the Safe core protocol, nor did it originate from Aave or rsETH.
Under normal operating conditions, the system dictates that the target must be an approved, allowlisted Safe, and the msg.sender must be a Module specifically enabled by that Safe. However, the system permitted any external caller to bypass these two essential security checks simply by assigning the target as address(this), which points back to the executor itself.
Once these verifications were circumvented, the bad actor executed a DELEGATECALL via a Safe Module that had already been enabled. This allowed the attacker to process arbitrary logic directly within the context of the victim's Safe.
The Sequence of the Attack
During the execution of the exploit, the attacker transferred roughly 2,900 aEthrsETH into a Uniswap v4 liquidity pool, pairing the assets against a PAT token that holds absolutely no value. Consequently, the compromised Safe was emptied of its real assets, leaving the victim with nothing but worthless junk LP NFTs.
Interestingly, the original attack transaction did not go exactly as the hacker planned. An MEV bot known as Yoink managed to front-run the exploit, intercepting the transaction and walking away with the entire stack of rsETH.
Exploit Overview
On September 15, 2026, a severe authorization bypass within a strategy executor resulted in the draining of a high-net-worth individual's #Safe wallet. This incident led to an approximate loss of $7.8M.
Understanding the Root Cause
The vulnerability was isolated to an unverified strategy executor located at the contract address 0x4f0055926c839D1d960a82CBF84E2eE933958ebC. It is important to emphasize that this flaw was not found in the Safe core protocol, nor did it originate from Aave or rsETH.
Under normal operating conditions, the system dictates that the target must be an approved, allowlisted Safe, and the msg.sender must be a Module specifically enabled by that Safe. However, the system permitted any external caller to bypass these two essential security checks simply by assigning the target as address(this), which points back to the executor itself.
Once these verifications were circumvented, the bad actor executed a DELEGATECALL via a Safe Module that had already been enabled. This allowed the attacker to process arbitrary logic directly within the context of the victim's Safe.
The Sequence of the Attack
During the execution of the exploit, the attacker transferred roughly 2,900 aEthrsETH into a Uniswap v4 liquidity pool, pairing the assets against a PAT token that holds absolutely no value. Consequently, the compromised Safe was emptied of its real assets, leaving the victim with nothing but worthless junk LP NFTs.
Interestingly, the original attack transaction did not go exactly as the hacker planned. An MEV bot known as Yoink managed to front-run the exploit, intercepting the transaction and walking away with the entire stack of rsETH.
