TechFlow News, May 25: According to an official post by Squid (@squidrouter) and on-chain security platform Blockaid (@blockaid_), a third-party Gnosis Safe module named “SquidRouterModule” was recently exploited on the Base and Ethereum networks. Approximately 86 Gnosis Safe wallets were compromised, resulting in losses totaling roughly $3.2 million. The stolen tokens were subsequently swapped for DAI via Uniswap V3 pools controlled by the attacker.
Squid explicitly stated that this module was neither developed, deployed, nor operated by Squid. It is solely a third-party product that independently chose to integrate Squid and adopted this naming convention; it bears no relation to Squid’s core routing contract (0xce16F69375520ab01377ce7B88f5BA8C48F8D666). The root cause of the vulnerability lies in the third-party module accepting constant strings supplied by callers as security verification credentials. Attackers exploited this flaw to execute arbitrary calldata, thereby stealing assets from victims’ Safe wallets. Funds, authorizations, and integrations of Squid users remain secure. Squid will continue monitoring the situation closely.
