Deep Analysis: The $6M Vault Nobody Owns — the Base wstETH Whitelist Takeover, a Full-Chain Review

1. What Happened

On the morning of Sunday, October 4, 2026, a vault contract on Base began losing its Aave V3 position. Blockaid flagged an ongoing exploit at 09:20 UTC with an initial estimate of $2.02M; roughly forty minutes later the running total had grown to about $6M as the outflow continued. The mechanism, reconstructed from on-chain records: the attacker borrowed 1,783.067 aBaswstETH — the receipt token representing wstETH supplied to Aave's Base market — against the vault's position, then redeemed the receipt tokens for approximately 1,783 wstETH, worth about $6M at the ~$3,386 wstETH print (ether near $2,720 that weekend; counts range $6.0–6.1M depending on the price moment). Roughly $31.7M in assets remained in the vault after the withdrawal. Five security firms watched the sequence in real time — Blockaid, PeckShield, CertiK, GoPlus Security and ExVul — which is why a Sunday-morning theft of an unnamed contract is documented minute by minute. The vault itself has never issued a statement.

2. The Architecture

Three structural facts define the target. First, the vault is an OpenZeppelin transparent proxy with a separate upgrade authority — a standard pattern that adds one more contract layer between the assets and whoever ultimately controls them. Second, its exposure is a leveraged Aave V3 position on Base: deposits parked as aBaswstETH, earning yield, with borrowing against the position restricted to an allowlist of approved contracts — a common treasury design that exists precisely so that arbitrary contracts cannot touch the position. Third, the vault's operating owner is a 3-of-7 Safe created through Safe Proxy Factory 1.4.1, whose seven signer addresses have never been publicly identified. Every piece of this architecture is conventional. That is the point: the setup that failed is the setup thousands of treasuries run this morning.

3. The Flaw: A Permission List Without a Named Owner

The exploitable property was not in the vault's math, Aave's risk engine, or Base's sequencer — all of it worked as written. It was in the answer to one question: who can change who can borrow? The allowlist — the control that was supposed to make the vault safe — is editable by the Safe, and the Safe's security is exactly the integrity of seven anonymous key-holders. On October 4 that control produced its own exploit: a freshly deployed attacker contract was admitted to the allowlist through a transaction signed with valid signer keys. Investigators consider two explanations, both phrased as possibilities rather than findings: the signers' keys were compromised, or the approval path itself was manipulated so signers confirmed something other than what they believed. Which of the two applies is unknowable from the chain — valid signatures are valid — and it is unknowable for an additional structural reason: no operator exists to ask. A multisig is a count of signatures, not a count of honest signers; seven anonymous keys with no published process, no timelock and no operational history are a control in name only.

4. The Attack, Step by Step

The on-chain sequence is short and, in one respect, damning. Before October 4, the vault's Safe had executed no transaction for 25 days — a seven-signer control holding tens of millions that had gone silent for most of a month. At 08:52 UTC on October 4, the Safe executed a transaction removing a contract belonging to the attacker from the borrowing allowlist. One minute later, at 08:53 UTC, the same Safe re-admitted the same contract. Both transactions carried cryptographically valid signatures; on-chain, no rule was broken and nothing could have been rejected. A remove-then-re-add of the same address inside sixty seconds does not read as an operating error — it reads as someone deliberately sequencing approvals, and the analyzing firms note it is equally consistent with manipulated signers confirming transactions they did not understand. With the attacker's contract whitelisted, the borrow-and-redeem followed: 1,783.067 aBaswstETH out of the vault, redeemed at Aave V3 for ~1,783 wstETH, moved to attacker-controlled addresses. The outflow ran long enough that real-time monitoring watched the estimate grow from $2.02M to ~$6M over roughly forty minutes.

5. The Unowned-Vault Problem

The strangest fact in this incident is organizational, not technical: nobody has claimed the vault. No project team has acknowledged it, no remediation plan exists, no statement explains the unauthorized allowlist change, and the seven signers remain anonymous. An unidentified on-chain user later sent the attacker a message encouraging them to withdraw the remaining ~$31.7M and requesting a tip — a piece of street theater that underlines the vacuum — with no verified response. The absence is load-bearing in both directions. It means there is no counterparty to negotiate a return, no team to pause anything, no incident-response process to fund, and no one to answer the one question that would make the sequence legible: were your signers phished, or are your signers the attacker? It also means the remaining $31.7M is protected by nothing but the attacker's patience — the same allowlist mechanism that released $6M can release the rest, and the only watcher is the monitoring industry.

6. Containment and Recovery

There was none, and the reason is instructive. Aave V3's Base deployment was never at risk, so there was no protocol-level emergency brake to pull; Base functioned throughout; and the vault — the only contract that could have restricted the borrowing — is governed by the same anonymous Safe that authorized the loss. Compare the containment options this column has recorded in comparable incidents: Cosmos Hub validators halted a healthy chain and swept $2.2M by consensus; issuers froze $318K of the Bitget haul at the token layer; NEAR Intents patched its own contract within an hour and recovered everything within 36. Here, every one of those levers requires an identified, reachable owner — and that is exactly what the vault does not have. The funds are simply gone, into wstETH liquidity, with the attacker holding liquid staking receipts that are as good as ether. The systemic risk remained contained, as the firms noted — no Aave market or Base infrastructure was impaired — but systemic containment is cold comfort to the depositors whose money is the vault.

7. The Money Trail

The ledger, as far as public sources carry it. In: one attacker contract deployment, two Safe transactions, one borrow. Out: 1,783.067 aBaswstETH borrowed against the vault's position; ~1,783 wstETH (~$6.0–6.1M at the prints used) redeemed at Aave V3 and moved to attacker-controlled addresses. Left behind: ~$31.7M in vault assets, reachable by the same mechanism. No freeze, no bounty, no negotiation and no claim exists as of this writing. The wstETH denomination is worth a sentence: the thief is holding staked-ether receipts, not an illiquid altcoin — there is no dump risk to monitor and no exchange chokepoint to watch, only an address to wait on. Selling ~1,783 wstETH could create brief market pressure, but the receipts' peg was never at risk; this is the cleanest possible exit an exploiter of this class can draw.

8. The Lesson

Three lessons, in descending order of portability. First, permission management is the attack surface that audits do not cover: the vault's calculation logic was fine, its Aave integration was fine, and its allowlist — the security feature — was the vulnerability, because the list is only as strong as the process that edits it. Any treasury should be able to answer, on paper, who its signers are, what they verified before signing, and how long a change sits in a timelock; '3-of-7' is a threshold, not a process. Second, operational silence is a signal you can monitor: the Safe had executed nothing for 25 days before two transactions a minute apart — a dormancy alarm on privileged safes would have flagged exactly this shape, and it costs nothing to run. Third, anonymity has a price and this vault paid it: an unclaimed contract cannot be paused, negotiated with, or defended, and its remaining $31.7M is now a countdown measured in the attacker's discretion. The general form holds from Neutron's governance vote to Bitget's backend to this allowlist: the layer that decides which actions are legitimate is the asset — and if that layer's owners are anonymous, the depositors are the only parties with something to lose.