A $7.81M rsETH exploit targeting a Gnosis Safe was front-run by the MEV bot yoink, which captured the entire amount via a delegatecall vulnerability in an authorized Safe module.
Security & Exploits ·
A $7.81M exploit targeting rsETH holdings was intercepted and profited from by the MEV bot yoink, which captured the entire amount by front-running the original attacker's transaction. The vulnerability stemmed from a whitelisted Safe module on a Gnosis Safe wallet that held leveraged rsETH funds; the module's recipe entrypoint failed to gate external callers before forwarding calls into the Safe's execTransactionFromModuleReturnData function with DELEGATECALL enabled, allowing unrestricted code execution within the Safe's context.
The original attacker had deployed a "Permissionless Attacker Token" and placed the exploit directly into the mempool, but the MEV bot detected and superseded the transaction. Because the vulnerable module was already an authorized Safe module on the target wallet, any caller reaching the entrypoint could drain its full asset balance.
It remains unclear whether the original attacker's true objective was to execute the exploit themselves or whether the mempool placement was deliberate. The incident highlights the compounding risk when leverage, modular Safe architectures, and public mempool visibility intersect; whale 0x40E9 ultimately incurred the full $7.81M loss regardless of which actor ended up profiting.