A $6 million exploit at an unnamed Base vault highlighted a gap in how security flaws are disclosed, according to Immunefi's head of security. The vault held approximately $31.7 million in assets when the incident was briefed. Around $6 million in wstETH was stolen after a malicious contract accessed the vault through a multisignature wallet. Seven signers of the vault's Safe wallet remained unidentified, and no public response emerged more than 24 hours after the attack. Immunefi's Gonçalo Magalhães stated that approved addresses could withdraw vault assets without requiring collateral, creating a vulnerability that bypassed standard protections. The whitelist mechanism, which appeared to restrict access, allowed any pre-approved address to move funds without collateral once authorized. Magalhães noted that the flaw had been identified a week prior, but the researcher faced limited options to address it without risking legal exposure. The researcher, operating under anonymity, could not safely intervene without clear disclosure channels. Base vault permissions enabled withdrawals without collateral, and the attacker used a Safe wallet to add a malicious contract to the whitelist before withdrawing 1,783 aBaswstETH and converting it to wstETH via Aave V3. Magalhães emphasized that the whitelist's design failed to account for the actions an approved address could take, turning a seemingly controlled access system into a critical weakness. The vault had remained inactive for 25 days before the exploit, according to TokenPost. The report suggested social engineering or collusion as possible causes for the access change, though neither was confirmed. Magalhães urged the vault operators to identify themselves and respond to the incident, calling their silence suspicious but not conclusive. He noted that the lack of ownership transparency and the approval process that allowed unauthorized access raised broader concerns about the vault's governance. Immunefi's CEO Mitchell Amador previously advocated for private vulnerability disclosure through structured bounty programs, citing the Liquid Network incident where stolen funds were partially returned but bounties were disputed. Amador argued that protocols should establish predefined rescue protocols, including researcher actions and reward terms, before emergencies occur. Immunefi's Whitehat Safe Harbor framework aims to formalize such conditions. Magalhães suggested that a bug bounty might have prevented the attack, as the vulnerability could likely have been detected through community monitoring. Immunefi's July bounty program distributed $2.32 million for confirmed vulnerabilities, with paid reports rising 18% from June. The company also reported preventing 374 threats and found that competitive audits uncovered more vulnerabilities than private ones. A separate Hacken analysis indicated that 88.3% of $764 million stolen in Q2 resulted from infrastructure or key compromises, not just smart contract flaws. Only 4% of projects combined audits, bug bounties, and third-party monitoring. Fourteen audited projects had later been exploited, highlighting risks from signer devices, administrator keys, and bridge validators. In the U.S., the Justice Department prosecuted security researcher Shakeeb Ahmed for stealing over $12 million from decentralized exchanges, later negotiating partial asset returns while retaining a portion. Another case involved Nirvana Finance, where Ahmed rejected a $600,000 bounty offer and kept nearly $3.6 million after failing to reach a settlement. These cases underscore the legal and financial stakes of unauthorized fund withdrawals in decentralized systems.