Base vault’s $6M exploit exposes a disclosure gap: Immunefi

cryptonews04:13

A $6 million exploit at an unidentified Base vault has exposed a gap in vulnerability reporting, according to Immunefi’s head of security, with roughly $31.7 million remaining in the vault at the time...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2673306348?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-10-07 04:13","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2673306348","market":"sh","top_or_hot":-1,"title":"Base vault’s $6M exploit exposes a disclosure gap: Immunefi","media":"cryptonews","content":"<div>\n<p>A $6 million exploit at an unidentified Base vault has exposed a gap in vulnerability reporting, according to Immunefi’s head of security, with roughly $31.7 million remaining in the vault at the time...</p>\n\n<a href=\"https://crypto.news/base-vault-6m-exploit-exposes-disclosure-gap-immunefi/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Base vault’s $6M exploit exposes a disclosure gap: Immunefi</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nBase vault’s $6M exploit exposes a disclosure gap: Immunefi\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-10-07 04:13 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/base-vault-6m-exploit-exposes-disclosure-gap-immunefi/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>A $6 million exploit at an unidentified Base vault has exposed a gap in vulnerability reporting, according to Immunefi’s head of security, with roughly $31.7 million remaining in the vault at the time...</p>\n\n<a href=\"https://crypto.news/base-vault-6m-exploit-exposes-disclosure-gap-immunefi/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"SETH","symbol_name":"1倍做空以太币期货ETF-Proshares","start_time":0,"source_url":"https://crypto.news/base-vault-6m-exploit-exposes-disclosure-gap-immunefi/","article_id":"2673306348","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/base-vault-6m-exploit-exposes-disclosure-gap-immunefi/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2673306348","pubTimestamp":1791317612,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"A $6 million exploit at an unidentified Base vault has exposed a gap in vulnerability reporting, according to Immunefi’s head of security, with roughly $31.7 million remaining in the vault at the time of the incident briefing.About $6 million in wstETH was taken after a malicious contract gained access to the vault.Seven Safe signers remained unidentified, with no public team response more than 24 hours later.Immunefi’s security chief said approved addresses could take vault assets without putting up collateral.Magalhes said a bug bounty could have caught the flaw, but anonymity complicated whitehat action.Gonalo Magalhes, head of security at Immunefi, told crypto.news that the vault’s unidentified operators left a whitehat researcher with few options to address its whitelist weakness without risking legal trouble.In the incident briefing accompanying his comments, the weakness had been identified the previous week, but the researcher had no clear disclosure channel. More than 24 hours","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"SETH":"1倍做空以太币期货ETF-Proshares","BK4601":"加密货币现货ETF","ETCO":"Grayscale Ethereum HIGH Income ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","ETH":"低成本以太坊ETF-Grayscale","TETH":"21Shares Ethereum ETF","ESK":"REX-Osprey ETH + Staking ETF"},"translate_title":"Base vault 的 600 万美元漏洞暴露了信息披露漏洞： Immunefi","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"TETH":0.6,"ESK":0.6,"SETH":0.6,"ETQ":0.6,"ETH":0.76,"ETCO":0.6},"content_text":"A $6 million exploit at an unidentified Base vault has exposed a gap in vulnerability reporting, according to Immunefi’s head of security, with roughly $31.7 million remaining in the vault at the time of the incident briefing.\n\n\nSummary\n\n\n\nAbout $6 million in wstETH was taken after a malicious contract gained access to the vault.\nSeven Safe signers remained unidentified, with no public team response more than 24 hours later.\nImmunefi’s security chief said approved addresses could take vault assets without putting up collateral.\nMagalhães said a bug bounty could have caught the flaw, but anonymity complicated whitehat action.\n\n\n\nGonçalo Magalhães, head of security at Immunefi, told crypto.news that the vault’s unidentified operators left a whitehat researcher with few options to address its whitelist weakness without risking legal trouble.\nIn the incident briefing accompanying his comments, the weakness had been identified the previous week, but the researcher had no clear disclosure channel. More than 24 hours after the attack, the briefing said no team had publicly claimed the vault, acknowledged the loss, or announced remediation.\nBase vault permissions allowed withdrawals without collateral\nTokenPost reported that the attacker used a Safe multisignature wallet to add a malicious contract to the vault’s lending whitelist. According to its account, the contract then withdrew 1,783 aBaswstETH and redeemed the tokens through Aave V3 for about 1,783 wstETH.\nUnder Magalhães’ assessment, restricting access to approved addresses gave the appearance of protection because attackers would normally struggle to enter the whitelist. Once an address received approval, however, the vault allowed it to take assets without providing collateral, he said.\n\n“But considering any whitelisted address could take the vault’s aBaswstETH with no collateral needed, it actually becomes a major vulnerability.”\n\nThe security chief described the whitelist itself as insufficient protection against that withdrawal capability. His explanation focused on what an approved address could do with the funds after gaining access, rather than simply whether access was restricted.\nBefore the exploit, the vault had gone 25 days without executing a Safe transaction, according to TokenPost. The publication mentioned social engineering and collusion as possible explanations for the access change, while stating that neither had been established.\nWith seven Safe signers still unidentified in the incident briefing, Magalhães called on the people controlling the wallet to identify themselves and respond. He said their continued silence warranted suspicion, without presenting that concern as proof of involvement in the theft.\nAn unnamed vault left the whitehat without clear protection\nFor the researcher who found the weakness, Magalhães said the lack of an identified operator complicated any attempt to intervene safely.\n\n“Considering this is an unidentified vault, a whitehat can hardly perform any action with guarantee not to leave them in legal trouble.”\n\nIn his comments, the problem was not limited to finding a technical flaw. Magalhães also questioned the vault’s unknown ownership and the approval that allowed a threat actor onto its whitelist, saying both raised suspicions about its creators.\nOn Sep. 21, Immunefi CEO Mitchell Amador addressed private disclosure and authorization following the Liquid Network exploit. Amador said researchers should report weaknesses privately, preferably through a defined bounty program, rather than move user funds and negotiate payment afterward.\nIn that incident, unidentified actors returned 3,400 BTC but retained 598.5 BTC, according to the report. Blockstream rejected their claim of responsible disclosure and refused their demand for a 10% bounty.\nAmador said protocols should establish rescue conditions before an emergency, including the actions a researcher may take and the reward terms. The report also described Immunefi’s Whitehat Safe Harbor framework as a way to set those conditions in advance.\nBug bounties could catch flaws that audits miss\nAsked whether a bounty alone would necessarily have prevented the Base attack, Magalhães said the security community would probably have identified the contract’s withdrawal problem through a program.\n\n“A bug bounty could definitely have stopped this attack, since it’s probable the security community would have found this flaring problem in the smart contract.”\n\nIn an Aug. 10 report on July’s bug bounty results, Immunefi said researchers received $2.32 million for confirmed vulnerabilities during the month. Confirmed and paid reports increased 18% from June, while the company said its programs prevented 374 threats.\nThe same report cited Immunefi’s comparison of 1,178 audits by tier-1 firms and 58 competitive audits. According to the company, competitions found an average of 6.2 serious vulnerabilities per engagement, compared with 1.5 in private audits.\nBeyond contract logic, Magalhães pointed to infrastructure and key compromises as evidence that security checks must cover additional routes into user funds.\nOn July 20, a report on signer and infrastructure risks cited Hacken’s finding that those failures accounted for 88.3% of roughly $764 million stolen during the second quarter. Among 1,427 tracked projects, Hacken found that only 4% combined audits, active bug bounties and third-party monitoring.\nHacken also identified 14 exploited projects that had completed audits. According to its report, failures included signer devices, administrator keys, bridge validators, and backend systems outside the code covered by conventional reviews.\nU.S. prosecutions show the stakes of unauthorized withdrawals\nIn the United States, the Justice Department has prosecuted a security engineer who exploited decentralized exchanges and negotiated over the return of stolen assets.\nIn December 2023, federal prosecutors announced that Shakeeb Ahmed had pleaded guilty to computer fraud after hacking two exchanges and obtaining more than $12 million. According to the department, Ahmed agreed to return funds to one exchange except for $1.5 million if it did not report the attack to law enforcement.\nIn the separate Nirvana Finance attack, prosecutors said the protocol offered Ahmed a bounty of up to $600,000 to return the stolen assets. He demanded $1.4 million instead, reached no agreement, and kept the approximately $3.6 million he had taken, according to the Justice Department.\n\n\n\n\n\n                Read more:\n            \nSecuritize, LG CNS partner on tokenized assets in South Korea","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.50.1","shortVersion":"4.50.1","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2673306348","isCrawlerRequest":true}