Squid responds to about $3.2 million security incident: Core protocol unaffected, exploit targeted third-party Safe module

BlockBeats News, May 25th. Cross-chain protocol Squid issued a statement in response to a security incident, indicating that the attack did not occur in the Squid core protocol or Router contract. Instead, it was a third-party Gnosis Safe module named "SquidRouterModule" that had a severe vulnerability, leading to the theft of around $3.2 million in assets from Base and Ethereum.

Squid stated that this module was not developed, deployed, or operated by the official team but was merely an integration of Squid's functionality into a third-party smart wallet product. The attacker was able to bypass validation by inputting a public string, enabling them to execute arbitrary calls to steal funds. The affected wallet had previously designated this module as a trusted Safe Module, allowing asset transfers without the need for a signature.

Squid emphasized that its official Router contract, user funds, authorizations, and integrations were not affected and no further action is required.