GoPlus: A certain treasury contract on the Base chain was attacked, resulting in a loss of approximately 6 million USD, with 31.7 million USD in assets still at risk

According to the GoPlus security team, an unclaimed treasury contract on the Base chain was attacked. The attacker added a malicious contract to the lending whitelist through Safe multi-signature and withdrew 1783 aBaswstETH, then redeemed approximately 1783 wstETH on Aave V3, resulting in a loss of about 6 million dollars.

It is reported that the attack stemmed from failures in multi-signature governance and access control. The project team had not executed Safe transactions on the treasury contract for 25 days prior to the attack, which may have been due to social engineering attacks or internal collusion; the core contracts of Aave and the Base chain itself were not affected. As of the time of publication, approximately 31.7 million dollars in assets remain at risk in the attacked treasury.