Slow Mist: Aave V3 Loop Safe Module vulnerability caused approximately 114.09 ETH to be stolen

Slow Fog issued a security alert stating that the Aave V3 Loop Safe Module has a security vulnerability, allowing attackers to forge Safe authentication and execute arbitrary modules, stealing approximately 114.09 ETH from two Safe multi-signature wallets.

Attackers bypassed authentication by forging a Safe that always returns true and executed module transactions using a router and calldata that could be arbitrarily controlled, transferring weETH and Aave collateral. After repaying approximately 1300 WETH in debt, the attackers unlocked the collateral.