Blockchain security firm Blockaid reported on 25 May that it detected an ongoing exploit affecting 86 Gnosis Safe wallets over a roughly two-hour period. According to Blockaid, the attacker exploited a vulnerability in the executeSameChainActions() function tied to a contract verified as 'SquidRouterModule'. This allowed malicious transactions to impersonate authorized delegates and execute arbitrary token swaps from victim wallets, with the stolen assets allegedly swapped through attacker-controlled Uniswap V3 pools before being consolidated into roughly $3.07 million worth of DAI.
In a public response, Squid stated that the exploit did not affect its core contracts, users, or integrations. The protocol clarified that the vulnerable module was a 'third-party smart-wallet product' that integrated with Squid, but was not built, deployed, or operated by the company itself. 'The accurate framing is: a third-party SquidRouterModule was exploited, not Squid's Router contract,' the company wrote. Squid also claimed the vulnerable contract accepted a caller-supplied constant string as proof that a message was secure, allowing attackers to execute arbitrary calldata after the module was added as a trusted Safe module.
The incident underscores growing security concerns surrounding third-party wallet modules, delegated execution systems, and composable DeFi integrations. According to Blockaid, attackers increasingly exploit external permissions, middleware infrastructure, and auxiliary modules connected to broader ecosystems rather than targeting protocols' core contracts directly. The exploit allegedly combined Safe module permissions, delegate execution paths, and manipulated Uniswap liquidity pools to facilitate the theft. At the time of writing, no indication had emerged suggesting Squid's main router contract or core user funds were compromised.
As reported by Blockaid, the attacker deployed exploit contracts using Foundry tooling and created attacker-controlled tokens and liquidity pools as part of the exploit flow. Trusted Safe modules can spend assets without requiring additional signatures, which enabled attackers to drain tokens directly from affected wallets. The incident highlights how naming conventions and integrations can create reputational spillover during exploits, particularly when vulnerable third-party contracts reference larger protocols.
