# SlowMist reports 114 ETH loss through a third-party Safe loop module

Canonical: https://chainincident.com/news/84cfc377-e1d8-4eaa-af4a-63d0b47c0b05
Published: 2026-10-03T00:49:01.504Z
Publisher: Chain Incident

The reported authorization flaw affects an adapter enabled by two Safe wallets, rather than Aave’s core lending pools.

SlowMist reported on October 2 that a third-party module used to manage Aave v3 positions was exploited for approximately 114.09 ETH. The reported failure concerns FlashLoopAdapter, an extension enabled by two Safe wallets, rather than a breach of Aave's core lending pools.

In its [official alert](https://x.com/SlowMist_Team/status/2105855276536725599), the security firm identifies the access-control check in the adapter's open and close functions. The check asks the caller whether the adapter is an enabled module. SlowMist says a forged Safe contract can answer that question affirmatively, allowing the check to pass without establishing that the caller is an authorized wallet.

[The Crypto Times](https://www.cryptotimes.io/2026/10/02/aave-v3-loop-module-hacked-for-114-eth-aaves-pools-not-affected/) reports that the affected transaction occurred on October 1, before the public alert the following morning. Its account identifies two victim Safes and describes the loss as coming from those wallets. This publication has not independently reconstructed the transaction or audited the adapter's code.

The distinction between a wallet's signature threshold and its enabled modules is central to the incident. [Safe's documentation](https://docs.safe.global/advanced/smart-account-modules) explains that modules are separate smart-contract extensions. Once enabled, a module can execute transactions through the account's module interface, with authorization checks handled by the module's own logic.

That means counting the owners of a multisignature wallet is only part of reviewing its permissions. An extension with transaction authority also needs to be considered. Safe's documentation warns that modules can execute arbitrary transactions and recommends using trusted, audited modules.

For teams reviewing exposure, the relevant question is whether their particular Safe enabled this adapter, not simply whether they used Aave. A list of enabled modules and their contract addresses provides a more concrete starting point than a protocol name in a headline.

The available evidence does not establish a completed recovery or a verified patch. It also does not justify treating every Aave user or every Safe account as affected. The confirmed public development is SlowMist's warning about an adapter authorization flaw and its reported loss estimate.

## Sources

- [Safe module permissions and execution model](https://docs.safe.global/advanced/smart-account-modules) — Safe
- [SlowMist reports FlashLoopAdapter access-control exploit](https://x.com/SlowMist_Team/status/2105855276536725599) — SlowMist
- [Third-party Aave loop module exploit affects two Safe wallets](https://www.cryptotimes.io/2026/10/02/aave-v3-loop-module-hacked-for-114-eth-aaves-pools-not-affected/) — The Crypto Times

- [Editorial policy](https://chainincident.com/editorial-policy)
- [Request a correction](https://chainincident.com/corrections)