Third-Party Module Attack on Base and Ethereum Networks Results in $3.2 Million Loss

A recent attack on a third-party Gnosis Safe module on the Base and Ethereum networks has resulted in a loss of approximately $3.2 million. According to ChainCatcher, the incident is unrelated to Squid's core protocol and contracts, and all Squid users and integrators remain unaffected, with no action required on their part. The compromised contract, verified on Basescan as 'SquidRouterModule,' was not developed, deployed, or operated by Squid. Instead, it is a third-party smart wallet product that chose to integrate Squid and other protocols, having no direct connection to Squid. The attack exploited a vulnerability where the third-party module accepted a constant string provided by the caller as a message security proof. This string was visible in the verified contract code, allowing attackers to execute arbitrary calldata arrays and steal funds. Victims' Safe wallets added the problematic contract as a trusted Safe Module, enabling it to control any tokens within the Safe without requiring signatures. Squid's own routing contract (0xce16...D666) has a different architecture and remains unaffected. Squid users' funds, authorizations, and integrations are completely secure. Initial reports may have been misleading due to the contract verification name on Basescan mentioning 'SquidRouter.' The correct description is that the third-party SquidRouterModule was attacked, not Squid's Router contract. Although the contract name is similar to Squid's, it is not Squid's code. Squid is actively monitoring the situation and will provide updates if there are significant developments.