The Squid incident is drawing renewed attention to security risks tied to delegated permissions, wallet modules, and composable DeFi integrations.
$3mfollows public reports linking the incident to a contract named “ Squid RouterModule. ”that it detected an ongoing exploit affecting 86 Gnosis Safes over a roughly two-hour period.function tied to a contract verified as “ Squid RouterModule.
” This allowed malicious transactions to impersonate authorized delegates and execute arbitrary token swaps from victim wallets.before being consolidated into roughlyIn a public response, Squid said the exploit did not affect its core contracts, users, or integrations. The protocol stated that the vulnerable module was a “third-party smart-wallet product” that integrated with Squid.
However, it was not built, deployed, or operated by the company itself.
“The accurate framing is: a third-party SquidRouterModule was exploited, not Squid’s Router contract,” the company wrote. Squid also claimed the vulnerable contract accepted a caller-supplied constant string as proof that a message was secure. This allowed attackers to execute arbitrary calldata after the module was added as a trusted Safe module. Because trusted Safe modules can spend assets without requiring additional signatures, attackers were allegedly able to drain tokens directly from affected wallets.
The incident underscores growing security concerns surrounding third-party wallet modules, delegated execution systems, and composable DeFi integrations. Attackers increasingly exploit external permissions, middleware infrastructure, and auxiliary modules connected to broader ecosystems. They do this rather than targeting a protocol’s core contracts directly In this case, the exploit allegedly combined Safe module permissions, delegate execution paths, and manipulated Uniswap liquidity pools to facilitate the theft. The attack also highlights how naming conventions and integrations can create reputational spillover during exploits.
This happens particularly when vulnerable third-party contracts reference larger protocols. Blockaid said the attacker deployed exploit contracts using Foundry tooling and created attacker-controlled tokens and liquidity pools as part of the exploit flow. At the time of writing, no indication had emerged suggesting Squid’s main router contract or core user funds were compromised. Blockaid said an exploit involving a contract named “SquidRouterModule” drained roughly $3m from 86 Gnosis Safe wallets across Ethereum and Base.
Squid said the vulnerable module was a third-party integration unrelated to its core protocol or router contracts.
United States Latest News, United States Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Strategy's $64B Bitcoin gamble comes under fire as Peter Schiff cries 'Ponzi!'Does Bitcoin’s drop signal a breakdown or reinforce its safe-haven narrative?
Read more »
DeFi Resilience Remains Fragile Despite Growing Security FocusThe recent surge in cross-chain bridge exploits has reignited concerns about the stability of DeFi ecosystems, with institutions increasingly prioritizing security and stricter standards for bridge systems. While market participants are becoming more cautious, liquidity conditions are also improving as bridge exploits become less frequent. The question remains whether DeFi resilience can sustain this momentum.
Read more »
Enhanced Games: Olympics-Inspired Competition Tests Limits of Human Performance with Safe PED UseEvery two years, Enhanced Games, a company whose mission is to 'develop scientific insights, medical discoveries, and record-breaking sports events to unite humanity and inspire scientific innovation,' hold events featuring track, swimming, weightlifting, and a strongman exhibition. These games are similar to the Olympics, except they focus on encouraging safe use of performance-enhancing drugs (PEDs), sparking controversy among athletes, the International Olympic Committee (IOC), and the World Anti-Doping Agency (WADA). The Enhanced Games' opening events begin on May 24.
Read more »
Inertia exploit shows old ERC4626 vulnerabilities still threaten DeFi lending protocolsInertia’s post-mortem revealed how attackers manipulated roETH collateral pricing through an old ERC4626 weakness before draining assets across five lending markets.
Read more »