Base: exploit in progress, near $6M lost

[LuckyCrypto777]

Blockaid reports an ongoing exploit on one of the Vaults in Base (name withheld).
The scheme is as follows: a newly created contract was pushed onto the Vault's whitelist, which borrowed aBaswstETH and sent aTokens to the attacker's contract.

Approximately $6M has already been lost in approximately four transactions. The attack is still ongoing.

Exploit addresses:
https://basescan.org/address/0x0B5126e1bc27C0de77e02e97945760A674EdB034

https://basescan.org/address/0xcdFE91301356da873562EF513828a60dba1F569d

https://basescan.org/address/0x5D7a38144b4D17F47a22e3d0987523CD68B43310

Exploit transaction example:

https://basescan.org/tx/0xed265fc80e4abe42d72d6bfd1623c89dd2d12f544d53d4ca2c9c3d0fefbf2810

Source

[stadus]

Always add the source like this

Base Vault Attack Drives Reported Losses to About $6 Million

An attack on a vault on Base has driven losses to about $6 million, involving roughly 1,783 wstETH.

The attacker added a new contract to the vault’s whitelist, borrowed aBaswstETH and transferred it to the attacker’s contract. The identified address is 0x0B5126...B034.

The reported losses have expanded from an earlier estimate of about $2 million.

[LuckyCrypto777]

Always add the source like this

Base Vault Attack Drives Reported Losses to About $6 Million

An attack on a vault on Base has driven losses to about $6 million, involving roughly 1,783 wstETH.

The attacker added a new contract to the vault’s whitelist, borrowed aBaswstETH and transferred it to the attacker’s contract. The identified address is 0x0B5126...B034.

The reported losses have expanded from an earlier estimate of about $2 million.

Please pay close attention when reading, I have add the source of the news from the beginning

Source

[shinratensei_]

How could the contract get whitelisted if not because insider . Yet another case where multisig is working great but the guys behind the multisig are the problem.And yet when such exploit happens, AAVE always take the hit with the bad debt from the exploit which is getting borrowed against.

From another news, look at this :

The most significant detail so far comes from ExVul’s follow-up timeline. According to ExVul, the vault owner’s Safe, a multisignature (multisig) smart contract wallet that requires several approvals for each transaction, removed the attacker contract from the whitelist at 08:52 UTC. One minute later, at 08:53 UTC, the same Safe re-enabled it.

ExVul said both administrative transactions showed three successful Elliptic Curve Digital Signature Algorithm (ECDSA) signature recoveries under the same signing identities. In simple terms, the changes carried valid approvals from the Safe’s existing signers. The first borrow came about 70 seconds after the contract was re-enabled.

This places the focus on how those approvals were obtained, rather than on a flaw in Aave or in the vault’s lending logic. Whether the signers’ keys were compromised, a signing process was manipulated, or another failure occurred has not been confirmed by any party.

source

The attacker contract got removed only to get whitelisted again 1 minute later.

[stadus]

Please pay close attention when reading, I have add the source of the news from the beginning

Source

Sorry OP, I stand corrected. ( my bad, i didn't see it).