FlashLoopAdapter — Spoofable Safe-module access control drains two Safes

The adapter was deployed on Jul 16, 2026; the Safes' owner enabled it as a module on Jul 17 and last used it on Jul 18 and Jul 27; it then sat enabled and unused for 66 days. On Oct 1 at 14:15:23 UTC the attacker wallet was funded through Railgun, at 14:44:23 it deployed a factory and at 15:02:47 the attack contract. At 15:08:47 UTC one transaction took 114.096151469674448809 ETH out of two Safes. Two flaws combined: open()/close() only checked ISafe(msg.sender).isModuleEnabled(address(this)), which a fake Safe answers 'true' (SlowMist root cause), and _swap() made a raw call to a caller-supplied router with caller-supplied calldata. The attacker flash-borrowed 11,537.2397 WETH from Morpho, repaid the Safe's whole 1,335.2558 WETH Aave debt, then had the adapter call execTransactionFromModule on each Safe: 1,306.4823 weETH were withdrawn from the Aave position and 6.426087 weETH taken from the other Safe, sold through Velora, Fluid, Curve and Uniswap for 1,449.35 WETH; after repaying Morpho 114.096 ETH remained (about $305,900 at that hour). TraceFast also reports that the adapter's flashLoan call was pointed at the attack contract itself (a 'fake Morpho'). At 16:45:59 UTC the ETH moved to a fresh address and at 16:46:59 UTC into Railgun. At 21:03:23 UTC the Safes' owner sent an on-chain message offering a 10% whitehat bounty (keep 11.41 ETH, return 102.69 ETH before Oct 3 at 18:00 UTC); no reply or return is visible. Aave said its v3 core was unaffected. The module was disabled on both Safes at 16:32:23 UTC.