# RsETHSafeModule: self-referential multicall bypass drains Gnosis Safe

A private DeFi-Saver router's multicall authorized any call whose target was the router itself, letting an attacker self-call into an enabled Safe module and DELEGATECALL a recipe that drained 2,900 aEthrsETH.

- Payout: Real-world hack
- Severity: critical
- Program: RsETHSafeModule
- Disclosed: 2026-09-15
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-09/RsETHSafeModule_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260915-rsethsafemodule
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained technique:source-review vuln:access-control vuln:auth-bypass

**Target:** Private DeFi-Saver-style multicall router + enabled Gnosis Safe module
**Root cause:** Router's multicall(address,bytes[]) gates authorization on the target address and treats _contract == address(this) as authorized, so an attacker wraps the payload in a self-call to run with the Router's trusted identity. The enabled Safe module then trusts the Router and forwards execTransactionFromModuleReturnData with operation=1 (DELEGATECALL).
**Steps:**
1. Call `multicall(ROUTER, [nested])` on 0x4f00...8ebC — outer call passes because target == Router.
2. Nested payload is `multicall(MODULE, [moduleCall])` on 0xeA18...C4ca; module trusts Router as caller.
3. Module calls Safe `execTransactionFromModuleReturnData(RecipeExecutor, 0, executeRecipe(...), 1)` with operation=1 (DELEGATECALL).
4. Recipe delegatecalled in Safe context withdraws 2,900 aEthrsETH from Aave and deposits into Uniswap V4 PoolManager.
5. Attacker's pre-positioned hooked V4 pool sweeps aEthrsETH to rsETH; frontrunner nets 2,882.37 rsETH.
6. Negative control: calling `multicall(MODULE,...)` directly reverts — the self-referential outer wrap is the whole bug.
**How found:** Reconstructed from the on-chain trace: noticed Router -> Router self-call -> module -> Safe execTransactionFromModuleReturnData with operation=1, and that isModuleEnabled(0xea18b) was true. Confirmed selector 0x00c25829 and that removing the self-referential outer wrap reverts.
**Exploitation:** Permissionless: attacker needs no privilege over the victim Safe. Wraps a module call in a self-referential multicall to the Router, which forwards a DELEGATECALL recipe into the Safe, moving the Safe's Aave rsETH collateral into a Uniswap V4 PoolManager where the attacker's hooked pool captures it as rsETH. MEV frontrunner won the race and netted 2,882.37 rsETH (~$7.73M).
**Escalation:** Chained router auth bypass -> trusted module -> Safe DELEGATECALL -> Aave collateral withdrawal -> V4 pool capture; MEV frontrunning race for the capture leg.
**Insight:** When a multicall-style router authorizes by target address, check whether target == address(this) is treated as trusted; a self-call can launder an untrusted payload into any downstream contract that trusts the router as msg.sender, including Safe modules that forward DELEGATECALL.