Third-party SquidRouterModule Hack
Reported loss
$3.2M
Access Control
What happened
On May 25, 2026, a third-party Gnosis Safe module named SquidRouterModule was exploited across Ethereum and Base, draining roughly $3.2 million from 86 Safes. Squid stated that it neither built nor deployed the module and that its core router was unaffected.
Technical root cause
According to the reported analysis, the third-party module treated a caller-supplied constant string as authorization and then allowed arbitrary calldata through its delegated execution path. This was not a vulnerability in Safe's core contracts or Squid's core router.
How it happened
- Reporting says the attacker supplied the publicly readable constant to pass the module's authorization check, then used its delegate-execution path to move assets from Safes that had enabled the module without owner signatures.
- The stolen assets were reportedly swapped through attacker-controlled Uniswap V3 pools and consolidated into DAI.
Protocol details
Classification
Other / Access Control
Protocol Type
Exploit/Access control
Implementation language
Solidity
Evidence
Proof of concept
1 availableSources
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
