Unidentified Base Network Vault Exploited for $6 Million via Whitelist Vulnerability

According to reports from Odaily Planet Daily on Dec. 12, an unidentified vault on the Base network suffered a $6 million exploit. Gonçalo Magalhães, Head of Security at Immunefi, revealed that the attacker utilized a Safe multisig wallet to add a malicious contract to the vault's lending whitelist. This maneuver allowed the perpetrator to withdraw 1,783 aBaswstETH, which were subsequently swapped for wstETH via Aave V3. Despite the attack, approximately $31.7 million remained in the vault. Magalhães noted that while the whitelist mechanism appeared secure, it permitted approved addresses to withdraw assets without collateral. Although researchers had identified the vulnerability during the week of Dec. 4, a lack of clear disclosure channels delayed reporting. As of Dec. 12, more than 24 hours after the incident, no project team has claimed responsibility for the vault or announced remediation plans.