Missing Disclosure Channel Leads to $6M Exploit

An exploit draining $6 million from an anonymous decentralized finance vault on the Base network has spotlighted severe gaps in vulnerability reporting mechanisms. According to an incident briefing and comments from Immunefi head of security Gonçalo Magalhães, roughly $31.7 million remained in the unidentified vault at the time of the report.

The attacker utilized a Safe multisignature wallet to append a malicious contract to the vault’s lending whitelist, according to an account from TokenPost cited in the incident briefing. Once whitelisted, the contract siphoned 1,783 aBaswstETH. These tokens were subsequently redeemed via Aave V3 for approximately 1,783 wstETH.

The primary technical flaw stemmed from the fact that an approved address was permitted to withdraw assets without providing collateral.

“But considering any whitelisted address could take the vault’s aBaswstETH with no collateral needed, it actually becomes a major vulnerability,” Magalhães stated.

Disclosure Dilemma

The weakness had actually been discovered by a security researcher the week prior to the attack. However, because the vault operators were unidentified and offered no designated reporting channel, the researcher had no secure method to warn the protocol.

“Considering this is an unidentified vault, a whitehat can hardly perform any action with guarantee not to leave them in legal trouble,” Magalhães said.

He noted that the unknown creators and the lingering silence from the seven unidentified Safe signers warranted suspicion, though it was not presented as proof of internal involvement. More than 24 hours after the theft, no team had come forward to claim the vault, acknowledge the loss, or propose a remediation plan. The vault had previously gone 25 days without executing a Safe transaction, with TokenPost suggesting collusion or social engineering as possible, though unestablished, causes for the unauthorized access.

Establishing clear rules of engagement remains a pressing issue for the sector. Immunefi CEO Mitchell Amador recently emphasized that protocols must set rescue conditions prior to an emergency. He cited a September 21 exploit on the Liquid Network where unknown actors returned 3,400 BTC but retained 598.5 BTC. Following the incident, Blockstream denied their responsible disclosure claim and refused a 10% bounty request.

The legal hazards for security researchers acting without explicit permission are substantial. In December 2023, federal prosecutors secured a guilty plea from Shakeeb Ahmed, who hacked two exchanges for over $12 million. In a separate incident involving Nirvana Finance, prosecutors noted Ahmed was offered a $600,000 bounty to return assets but instead demanded $1.4 million, ultimately keeping about $3.6 million.

Security Blind Spots

To prevent such occurrences, security professionals advocate for proactive bounty structures.

“A bug bounty could definitely have stopped this attack, since it’s probable the security community would have found this flaring problem in the smart contract,” Magalhães stated.

Beyond contract logic, access control failures continue to dominate financial losses. A July 20 report citing Hacken found that infrastructure and signer device failures caused 88.3% of the roughly $764 million stolen during the second quarter. Out of 1,427 tracked projects, a mere 4% utilized a combination of audits, active bug bounties, and third-party monitoring. Furthermore, 14 of the exploited projects had actually completed audits, revealing blind spots in administrative keys, bridge validators, and backend systems.