What happened
On May 25, 2026, attackers drained about $3.98 million from 88 New Market Trading client Safes across Ethereum, Base, and Arbitrum. The affected third-party module trusted a caller-supplied source string and a delegate address supplied in its payload instead of authenticating the caller. Attackers then forced swaps through pools they controlled and consolidated the proceeds into DAI.
How it happened
- The attacker read the public permission registry to identify a delegate with APPROVE and SWAP permission on each target Safe.
- They called the module's permissionless express path with the expected source string and the real delegate address encoded in the payload.
- The module checked the payload delegate rather than the caller, so it executed privileged actions for an unauthorized caller.
- The Safes approved token movement and were forced to swap their assets through attacker-controlled pools; the proceeds were consolidated into DAI.
Protocol details
Classification
Access Control
Protocol Type
Other
Implementation language
Solidity
Evidence
Proof of concept
1 availableSources
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
