Base vault drained of $6M in Aave deposit tokens after whitelist change

Key Summary

A DeFi vault on Base lost approximately 1,783 wstETH, valued at around $6 million, after a malicious contract was added to the vault's borrower whitelist. The change occurred between 08:52 and 08:53 UTC, with two whitelist changes authorized by the same signers. The malicious contract borrowed aBaswstETH, which was then redeemed for wstETH, and some stolen funds were routed through Lido's Base-to-Ethereum bridge. The vault's 3-of-7 Safe multisig had not executed a transaction in 25 days before the attack, and it remains unclear how the required signatures were obtained. The vault still holds around $31.7 million in assets.