Base vault loses $6m after malicious contract approval

What happened

An unnamed vault on Base lost about $6m on 4 October after a newly approved contract used its borrowing path. ExVul reports six outflows totalling 1,783.067 aBaswstETH, tokens representing deposited wrapped staked Ether on Aave.

The controlling Safe wallet accepted three owner signatures on a preceding permission call. How those approvals were obtained remains unresolved. The recipient later redeemed the receipt tokens for about 1,783.067 wstETH; that redemption moved the same assets. The observed failure concerns the vault’s permissions and borrowing path. Blockaid’s earlier $2.02m alert was an interim estimate.