Hacker steals $7.73 million via Gnosis Safe router bug

An unknown attacker has stolen approximately $7.73 million from a Gnosis Safe wallet. The theft was made possible by a critical security vulnerability in a Router contract that contained incorrect verification of permissions.

In brief:

• Attacker made off with $7.73 million from a Gnosis Safe wallet
• Security vulnerability was in the multicall function of a Router contract
• The thief used DelegateCall and a fake liquidity pool to exchange the stolen aEthrsETH

How the attack worked

The problem lay in the multicall(address, bytes[]) function of the Router contract. The _contract parameter could be set to the contract itself, causing the internal _isAuthorized verification function to automatically give the green light without actually checking permissions.

This gap allowed the attacker to execute malicious instructions via DelegateCall. The thief then injected aEthrsETH tokens into a self-created liquidity pool equipped with a hook. By means of a swap, the attacker was able to convert the stolen tokens into profit.

Details of the breach

The attacker operated through the address 0x2f7e143e27f2fa26ef3b8ac72698f1d321422f67, while the victim was wallet 0x40e93a52f6af9fcd3b476aedadd7feabd9f7aba8. The secured contract had the address 0x4f0055926c839d1d960a82cbf84e2ee933958ebc. The transactions can be followed on Etherscan for anyone who wants to study the technical details further.

Security firm SlowMist, which analysed the attack, warned developers about this type of vulnerability in smart contracts where internal verifications do not provide sufficient protection against advanced exploit techniques.