{"id":183376,"date":"2026-10-02T07:25:11","date_gmt":"2026-10-02T07:25:11","guid":{"rendered":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/"},"modified":"2026-10-02T07:25:11","modified_gmt":"2026-10-02T07:25:11","slug":"aave-v3-faille-flashloopadapter-ethereum-hack-safe","status":"publish","type":"post","link":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/","title":{"rendered":"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $"},"content":{"rendered":"<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/content-img-1-3.jpg\" alt=\"Un piratage de FlashLoopAdapter sur Ethereum a caus\u00e9 une perte nette estim\u00e9e \u00e0 305 000 $ pour deux portefeuilles Safe, tandis qu'Aave affirme que ses contrats principaux ne sont pas affect\u00e9s.\"><\/figure><p>Un adaptateur personnalis\u00e9, le FlashLoopAdapter, utilis\u00e9 pour g\u00e9rer des positions \u00e0 effet de levier sur <a href=\"https:\/\/www.coingecko.com\/en\/coins\/aave\" target=\"_blank\" rel=\"noreferrer noopener\">Aave<\/a> V3, a \u00e9t\u00e9 exploit\u00e9 lors d&rsquo;un hack sur Ethereum. Cette attaque a laiss\u00e9 deux portefeuilles Safe avec une perte nette estim\u00e9e \u00e0 114,09 ETH, soit environ 305 000 $.<\/p><p>L&rsquo;attaquant a falsifi\u00e9 une v\u00e9rification d&rsquo;authentification Safe, puis a utilis\u00e9 un flash loan Morpho en WETH pour rembourser la dette et d\u00e9bloquer le collat\u00e9ral. Les quelque 1 306 weETH retir\u00e9s de l&rsquo;un des portefeuilles repr\u00e9sentaient un flux de transaction brut, et non les b\u00e9n\u00e9fices nets de l&rsquo;attaquant.<\/p><p><\/p><blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">SlowMist: Aave v3 Loop Safe Module Exploited, Approximately 114.09 ETH Stolen<br><br>SlowMist issued a security alert stating that Aave v3 Loop Safe Module was exploited through an access-control vulnerability in FlashLoopAdapter\u2019s open() and close() functions. The attacker allegedly\u2026 <a href=\"https:\/\/t.co\/a97iMcGWnI\">pic.twitter.com\/a97iMcGWnI<\/a><\/p>&mdash; Wu Blockchain (@WuBlockchain) <a href=\"https:\/\/x.com\/WuBlockchain\/status\/2105880875393229143?ref_src=twsrc%5Etfw\">October 2, 2026<\/a><\/blockquote><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><p>Defimon Alerts a d\u00e9clar\u00e9 avoir d\u00e9tect\u00e9 l&rsquo;attaque sur Ethereum \u00e0 15:08:57 UTC le jeudi 1er octobre. SlowMist a publi\u00e9 son analyse le vendredi 2 octobre, identifiant une faiblesse dans les fonctions d&rsquo;ouverture et de fermeture de l&rsquo;adaptateur. Un contrat malveillant a pu se faire passer pour un Safe et renvoyer cette valeur, contournant ainsi une v\u00e9rification destin\u00e9e \u00e0 confirmer qu&rsquo;un portefeuille l\u00e9gitime avait activ\u00e9 le FlashLoopAdapter.<\/p><p>Le contrat contr\u00f4l\u00e9 par l&rsquo;attaquant a \u00e9galement fourni le routeur de swap et les calldata de l&rsquo;adaptateur. Il a dirig\u00e9 le routeur vers un Safe victime et a configur\u00e9 les calldata pour invoquer <em>execTransactionFromModule<\/em>. Comme le FlashLoopAdapter \u00e9tait d\u00e9j\u00e0 activ\u00e9 sur ce Safe, le portefeuille a accept\u00e9 l&rsquo;appel comme une transaction de module autoris\u00e9e.<\/p><p>Cette s\u00e9quence a transform\u00e9 une faille d&rsquo;authentification mineure en un acc\u00e8s complet au collat\u00e9ral contr\u00f4l\u00e9 par le portefeuille. L&rsquo;\u00e9pisode souligne \u00e0 quel point les permissions des portefeuilles et les chemins d&rsquo;ex\u00e9cution sont cruciaux, parall\u00e8lement \u00e0 la s\u00e9curit\u00e9 du protocole de pr\u00eat lui-m\u00eame, une pr\u00e9occupation \u00e9galement centrale pour les infrastructures de garde et les contr\u00f4les d&rsquo;authentification.<\/p><h2 class=\"wp-block-heading\">Le flash loan a rembours\u00e9 la dette Aave avant le retrait du collat\u00e9ral<\/h2><span class=\"replacer\"><\/span><p>L&rsquo;attaquant a utilis\u00e9 un flash loan Morpho libell\u00e9 en WETH pour rembourser environ 1 335 WETH de dette Aave associ\u00e9e au plus grand Safe. Ce remboursement a lib\u00e9r\u00e9 le collat\u00e9ral li\u00e9 \u00e0 sa position \u00e0 effet de levier, permettant le retrait d&rsquo;environ 1 306 weETH. Un deuxi\u00e8me Safe a perdu environ 6,4 weETH via le m\u00eame module vuln\u00e9rable.<\/p><p>Les deux portefeuilles Safe concern\u00e9s appartenaient au m\u00eame propri\u00e9taire. Une fois les fonds emprunt\u00e9s r\u00e9gl\u00e9s et certains actifs convertis, l&rsquo;attaquant a conserv\u00e9 environ 114,09 ETH, une somme \u00e9valu\u00e9e par les rapports de s\u00e9curit\u00e9 \u00e0 environ 305 000 $.<\/p><p>La distinction entre le mouvement brut et la perte r\u00e9alis\u00e9e est essentielle. Le retrait massif de collat\u00e9ral a permis le remboursement de la dette et le d\u00e9bouclage de la position ; il ne doit pas \u00eatre interpr\u00e9t\u00e9 comme le montant vol\u00e9. Le produit net rapport\u00e9 correspond \u00e0 l&rsquo;ETH restant apr\u00e8s ces \u00e9tapes de transaction.<\/p><h2 class=\"wp-block-heading\">Aave affirme que les contrats core ne sont pas touch\u00e9s<\/h2><span class=\"replacer\"><\/span><p>Le fondateur et PDG d&rsquo;Aave, Stani Kulechov, a pr\u00e9cis\u00e9 que le composant vuln\u00e9rable \u00e9tait une int\u00e9gration externe plut\u00f4t qu&rsquo;un contrat Aave V3, et qu&rsquo;il n&rsquo;avait eu \u00ab aucun effet sur Aave v3 \u00bb.<\/p><p><\/p><blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">This is not Aave v3 contract, it\u2019s third party external adapter built on top of Aave, zero effect on Aave v3.<\/p>&mdash; Stani (@StaniKulechov) <a href=\"https:\/\/x.com\/StaniKulechov\/status\/2105892291638436078?ref_src=twsrc%5Etfw\">October 2, 2026<\/a><\/blockquote><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script><p>SlowMist a class\u00e9 l&rsquo;incident comme une vuln\u00e9rabilit\u00e9 de smart contract et a attribu\u00e9 le contournement \u00e0 la v\u00e9rification Safe falsifiable. Defimon a d\u00e9crit le FlashLoopAdapter comme un module Safe permettant d&rsquo;ouvrir et de fermer des boucles de levier sur Aave V3, estimant la perte \u00e0 environ 305 000 $.<\/p><p>Le FlashLoopAdapter est un contrat personnalis\u00e9 construit sur Aave V3 pour g\u00e9rer les positions \u00e0 effet de levier dans les Safes qui l&rsquo;ont activ\u00e9. Les modules Safe peuvent ex\u00e9cuter des transactions de portefeuille sans n\u00e9cessiter le flux de transaction standard du propri\u00e9taire \u00e0 chaque fois, ce qui facilite l&rsquo;automatisation mais offre aussi \u00e0 un module autoris\u00e9 une voie d&rsquo;acc\u00e8s aux actifs du portefeuille.<\/p><p>Dans ce cas pr\u00e9cis, la permission du module en elle-m\u00eame n&rsquo;\u00e9tait pas le bug rapport\u00e9 ; c&rsquo;est la logique d&rsquo;authentification de l&rsquo;appelant et d&rsquo;ex\u00e9cution de l&rsquo;adaptateur qui l&rsquo;\u00e9tait. L&rsquo;affaire constitue donc un \u00e9chec de s\u00e9curit\u00e9 DeFi au niveau de la couche d&rsquo;int\u00e9gration, et non une preuve que les pools de pr\u00eat d&rsquo;Aave V3 ont \u00e9t\u00e9 compromis.<\/p><p>La source primaire note \u00e9galement un incident distinct sur un portefeuille Safe en septembre, impliquant environ 2 900 rsETH et une autorisation faible dans un ex\u00e9cuteur connect\u00e9 \u00e0 un module activ\u00e9, mais les deux incidents concernent des contrats et des chemins d&rsquo;attaque diff\u00e9rents.<\/p>","protected":false},"excerpt":{"rendered":"<p>Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.<\/p>\n","protected":false},"author":605,"featured_media":183374,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[8,1],"tags":[],"editors":[2551],"sponsored_companies":[],"class_list":["post-183376","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-altcoin-news","category-news","editors-julien-leroy"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.2 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $<\/title>\n<meta name=\"description\" content=\"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $\" \/>\n<meta property=\"og:description\" content=\"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/\" \/>\n<meta property=\"og:site_name\" content=\"Cryptonews France\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-02T07:25:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:description\" content=\"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg\" \/>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $","description":"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/","og_locale":"fr_FR","og_type":"article","og_title":"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $","og_description":"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.","og_url":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/","og_site_name":"Cryptonews France","article_published_time":"2026-10-02T07:25:11+00:00","og_image":[{"width":1200,"height":675,"url":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg","type":"image\/jpeg"}],"twitter_card":"summary_large_image","twitter_description":"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.","twitter_image":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#article","isPartOf":{"@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/"},"author":{"name":"Julien Leroy","@id":"https:\/\/cryptonews.com\/fr\/#\/schema\/person\/6a10983b5de4b81926276b10a7665ee4"},"headline":"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $","datePublished":"2026-10-02T07:25:11+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/"},"wordCount":770,"commentCount":0,"publisher":{"@id":"https:\/\/cryptonews.com\/fr\/#organization"},"image":{"@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg","articleSection":["Actualit\u00e9s Altcoin","News"],"inLanguage":"fr-FR","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptonews.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/","url":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/","name":"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $","isPartOf":{"@id":"https:\/\/cryptonews.com\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#primaryimage"},"image":{"@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg","datePublished":"2026-10-02T07:25:11+00:00","description":"Une faille dans FlashLoopAdapter a permis le vol de 305 000 $ en ETH sur Ethereum. Aave confirme que ses contrats core restent s\u00e9curis\u00e9s.","breadcrumb":{"@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/"]}],"author":[]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#primaryimage","url":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg","contentUrl":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2026\/10\/aave-v3-faille-flashloopadapter-ethereum-hack-safe-featured.jpg","width":1200,"height":675,"caption":"Illustration abstraite d'une faille d'autorisation de portefeuille DeFi exposant des garanties lors d'une attaque par pr\u00eat flash (flash-loan)"},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.com\/fr\/news\/aave-v3-faille-flashloopadapter-ethereum-hack-safe\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.com\/fr\/"},{"@type":"ListItem","position":2,"name":"Aave V3 : une faille sur FlashLoopAdapter co\u00fbte 305 000 $"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.com\/fr\/#website","url":"https:\/\/cryptonews.com\/fr\/","name":"Cryptonews","description":"","publisher":{"@id":"https:\/\/cryptonews.com\/fr\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/cryptonews.com\/fr\/#organization","name":"Cryptonews France","url":"https:\/\/cryptonews.com\/fr\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/cryptonews.com\/fr\/#\/schema\/logo\/image\/","url":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2023\/09\/4.jpg","contentUrl":"https:\/\/cryptonews.com\/wp-content\/uploads\/sites\/3\/2023\/09\/4.jpg","width":1669,"height":874,"caption":"Cryptonews France"},"image":{"@id":"https:\/\/cryptonews.com\/fr\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/posts\/183376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/users\/605"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/comments?post=183376"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/posts\/183376\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/media\/183374"}],"wp:attachment":[{"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/media?parent=183376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/categories?post=183376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/tags?post=183376"},{"taxonomy":"editors","embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/editors?post=183376"},{"taxonomy":"sponsored_companies","embeddable":true,"href":"https:\/\/cryptonews.com\/fr\/wp-json\/wp\/v2\/sponsored_companies?post=183376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}