Base Vault Exploit Drains $2.02M as Attack Continues

The whitelisting mechanism, not the vault's asset handling, is the apparent point of failure here: an attacker got a freshly deployed contract approved, then used that position to borrow and redirect funds. That shifts the question from Base's settlement layer to how permissioned vaults vet contracts at the point of approval, a design tradeoff that recurs across curated and managed strategies. With the exploit still in progress, the immediate open questions are whether the drain is contained and how comparable vaults handle contract-level whitelisting.