Attacker Drains 2,900 rsETH From Gnosis Safe Wallet in Major Ethereum Heist
TL;DR
- An attacker drained 2,900 rsETH worth approximately $7.8 million from a Gnosis Safe wallet on the Ethereum network.
- They exploited a bug in an auxiliary contract authorized by the victim, not in Safe’s core contracts, according to BlockSec, Blockaid and SlowMist.
- An automated bot called “yoink” front-ran the attack transaction and captured the tokens, sending 2,882 rsETH to a separate address.
A bug in an auxiliary contract enabled the draining of a Gnosis Safe wallet for an amount equivalent to $7.8 million in rsETH, the liquid staking token issued by Kelp DAO.
The incident occurred early Tuesday on the Ethereum network and was detected by security firms BlockSec, Blockaid and SlowMist, which traced the origin of the flaw to an external component that the victim themselves had authorized.
ALERT! Our system detected an attack that drained ~$7.8M from a Gnosis Safe wallet on Ethereum (0x40E93a52F6Af9fCD3b476aeDADD7FeABD9f7AbA8).
The root cause was a flawed authorization check in the executor contract (0x4f0055926c839D1d960a82CBF84E2eE933958ebC). Setting the supplied… pic.twitter.com/LGb5T2cAOC… Continue reading the full article at the original source below.
