GebProxyActions Vulnerability Results in Loss of 5.94 ETH via SAFE Exploit

On September 2, 2026, blockchain security firm SlowMist reported a successful exploit targeting a vulnerability in the GebProxyActions smart contract. The incident resulted in the theft of approximately 5.9436 ETH. According to the security analysts, the primary cause of the asset loss was a lack of adequate caller access control within the contract, which allowed an attacker to manipulate a user's SAFE (a collateralized debt position or vault) after a procedural error by the victim.

Access Control Flaw in GebProxyActions

The vulnerability stems from the internal logic of the GebProxyActions contract, which facilitates interactions within the GEB ecosystem (often associated with protocols like RAI). SlowMist monitoring revealed that the victim user interacted with the contract incorrectly by calling the quitSystem function directly. In standard operations, users are expected to delegate such calls through DSProxy, a proxy identity contract that manages permissions and ownership of digital assets.

By bypassing the DSProxy layer, the user inadvertently triggered a state where the ownsSAFE status was compromised. Because the GebProxyActions contract failed to implement strict verification of the caller's identity or authority, an attacker was able to exploit the lack of access control to seize the collateral.

• Total Loss: Approximately 5.9436 ETH (Ethereum).
• Vulnerable Function: quitSystem within the GebProxyActions contract.
• Root Cause: Missing caller access control and improper use of proxy delegation.

Technical Implications and Security Recommendations

The exploit highlights a critical risk in DeFi protocols where action-helper contracts are used without robust internal permission checks. While DSProxy is designed to provide a secure execution environment, the underlying contracts must still verify that the entity interacting with them has the legal right to manage the specific SAFE or vault in question. In this instance, the separation of logic between the proxy and the action contract created a gap that the attacker utilized to drain the victim's funds.

"The victim user had previously directly called GebProxyActions.quitSystem instead of delegating the call through DSProxy, causing an ownership error that led to the theft", noted the SlowMist security team in their monitoring brief.

Developers are urged to implement strict require statements to validate that the msg.sender is an authorized proxy or the legitimate owner of the assets. Users are advised to only interact with complex DeFi protocols through verified front-end interfaces that correctly implement the necessary proxy calls to avoid manual errors that expose their funds to similar exploits.

The recovery of the 5.94 ETH remains uncertain as the assets have been moved by the attacker. This event serves as a reminder of the persistent risks associated with smart contract interactions and the necessity for comprehensive access control audits in decentralized finance.