Aave founder's response: The module involved is a third-party external adapter and is not affected by the Aave3 contract

On October 2, in response to SlowMist's report that the Safe module used in the Aave3 loop strategy was utilized and lost approximately 114.09 ETH (approximately 310,000 US dollars), Aave founder Stani Kulechov said that the incident was not an attack on the Aave3 contract. StaniKulechov said that the module involved was a third-party external adapter built on Aave3, and this incident had no impact on Aave3 itself. Previously, it was reported that the Avev3LoopSafe module was attacked. The attacker took advantage of the open()/close() access control vulnerability of the FlashLoopAdapter to steal approximately 114.09 ETH from two Safe multi-signed addresses by forging Safe authentication and arbitrary module execution, and repaid approximately 1300WETH debt to unlock collateral.