Worked example · 2026-10

Anonymous Base vault — the owner Safe removed and re-added an attacker contract to the whitelist inside one minute, with three valid signatures each time — unidentified vault / Base (Aave V3) — 2026-10-04

Loss

~1,783 wstETH (~$6M) — 1,783.067 aBaswstETH across six outflows (ExVul). Blockaid's first figure was ~$2.02M while the drain was in progress. One report puts ~$31.7M of further assets in the vault at the time; that is exposure, not loss. Part of the proceeds reportedly began bridging to Ethereum via Lido (unverified community tracking).

OAK Techniques observed

OAK-T11.003 (In-Use Multisig Smart-Contract Manipulation — primary at the signing layer, mechanism unconfirmed. The vault's owner Safe (seven signers) had been idle for 25 days; at 08:52 UTC it removed a newly deployed contract from the vault whitelist and at 08:53 UTC re-enabled it, each with three valid ECDSA recoveries under the same signer identities (ExVul). The first borrow followed ~70 seconds later. See techniques/T11.003-multisig-contract-manipulation.md). OAK-T9.004 (Access-Control Misconfiguration — the whitelist was the vault's only gate on who could borrow against its Aave position). Whether signer keys were stolen, signers were shown a misleading payload, or someone with legitimate access acted is not established. Aave and Base are not implicated.

Attribution

unattributed. The vault's operator has not identified itself; no post-mortem, freeze or bounty has been announced.

Disclosure note

Immunefi's head of security said a whitelist weakness had been identified the previous week, but researchers had no disclosure channel for an operator that does not publish who it is.

Key teaching point

A whitelist is as strong as the multisig that edits it, and an anonymous multisig cannot receive a warning. Two signed whitelist changes in one minute after 25 days of silence is a pattern a transaction-monitoring rule catches before the borrow; a timelock on whitelist additions turns those 70 seconds into a window for someone to react.