.jpeg)
Matcha Meta, a trading platform developed by 0x, has issued a critical security alert regarding a vulnerability in its integrated aggregator, SwapNet. The exploit has led to the draining of over $16.8 million in cryptocurrency, primarily affecting users who had disabled Matcha's One-Time Approval feature and granted direct token approvals to individual aggregator contracts.
Key Takeaways
-
Over $16.8 million in crypto was drained due to a SwapNet bug.
-
The vulnerability stemmed from an arbitrary call in the SwapNet contract, impacting users who disabled One-Time Approvals.
-
Matcha and SwapNet have disabled affected contracts, and users are urged to revoke manual token approvals immediately.
SwapNet Exploit Details
The security incident was brought to light by Matcha Meta, which noticed potential risks for users who had opted out of the platform's One-Time Approval system. Instead of using this safer method, these users had granted direct approvals to specific aggregator contracts, including SwapNet.
This direct approval mechanism allowed an attacker to exploit an "arbitrary call" vulnerability within the SwapNet contract. This exploit enabled the attacker to transfer funds that users had already approved without requiring any further authorization. On-chain data indicates significant activity, including nearly $10.5 million in USDC being swapped for 3,655 ETH on the Base network, with the attacker subsequently bridging these funds to Ethereum.
Security Firm Confirmations and Wider Impact
Blockchain security firms like PeckShield and BlockSec have confirmed the fund drain. PeckShield reported that approximately $16.8 million was drained, with a focus on the Base network activity. BlockSec's Phalcon platform identified that multiple victim contracts across Ethereum, Arbitrum, Base, and BNB Chain were targeted, with total losses potentially exceeding $17 million. They noted that the affected contracts were not open-source and exposed an "arbitrary-call" function, facilitating the draining of assets through transferFrom calls.
Two major impacted deployers were identified: 0xbeef63AE5a2102506e8a352a5bB32aA8B30B3112, with approximately $3.67 million lost, and 0x9cb8d9BaE84830b7f5F11ee5048c04a80b8514BA, with approximately $13.41 million lost.
Matcha's Response and User Guidance
In response to the incident, Matcha Meta has collaborated with the SwapNet team, leading to the temporary disabling of SwapNet's contracts. Matcha has also clarified that its core 0x protocol infrastructure, including AllowanceHolder and Settler contracts, was not affected. Users who consistently utilized Matcha's One-Time Approval system remain safe.
To mitigate further risks, Matcha Meta has removed the option for users to set direct allowances on aggregator contracts, preventing similar exploits in the future. The platform strongly advises all users to take the following actions:
-
Immediately revoke any approvals linked to SwapNet and other third-party aggregators.
-
Prioritize using Matcha's One-Time Approval system for future trades.
-
Stay informed about ongoing investigations and updates.
The incident underscores the importance of carefully managing token approvals in the DeFi space, especially when interacting with third-party services.
Sources
-
Matcha Meta Flags SwapNet Bug as Over $16.8M is Drained, The Crypto Times.
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.