GoPlus Security 🚦 (@GoPlusSecurity): 1/4

1/4 ⚠️ Exploit Breakdown On Sep 15, 2026, a whale’s #Safe wallet was drained via an auth bypass in its strategy executor. Loss: ~$7.8M. ❓ Root Cause Any caller could set the target to `address(this)` and skip both authorization checks, then `DELEGATECALL` through an already-enabled Safe Module — running arbitrary logic in the Safe’s own context. The attacker dumped ~2,900 aEthrsETH into a Uniswap v4 pool paired against a worthless PAT token, leaving the victim Safe with nothing but junk LP NFTs. The original exploit tx was front-run by MEV bot "Yoink", which walked away with the entire rsETH stack. 🔍 Attack Flow The bug sits in this unverified strategy executor: 0x4f0055926c839D1d960a82CBF84E2eE933958ebC Not in Safe core. Not in Aave. Not in rsETH. (1) Intended path: the target must be an allowlisted Safe, and `msg.sender` must be a Module enabled by that Safe. Set the target to `address(this)` — the executor itself — and both the allowlist check and the Module auth check get skipped.