On-chain decentralized exchange (DEX) aggregator SwapNet has suffered a major smart contract exploit, resulting in the loss of approximately $16.8 million in user funds. The attack was executed through the platform's integration with the meta DEX aggregator Matcha Meta, built by the 0x team.
Blockchain security firm PeckShield reported that the attacker targeted SwapNet-linked activity accessible via Matcha Meta. On the Base network, the attacker swapped roughly $10.5 million in USDC for about 3,655 ETH before bridging the funds to the Ethereum mainnet, a tactic commonly used to complicate tracking and recovery.
Matcha Meta clarified that the breach did not originate from its core infrastructure. The affected users were those who had opted out of 0x's "One-Time Approval" security system. This feature limits token permissions to single transactions. By disabling it, users granted persistent, direct approvals to underlying aggregator contracts, including SwapNet's router, which became the attack vector.
"We are aware of an incident with SwapNet that users may have been exposed to on Matcha Meta for those who turned off One-Time Approvals," Matcha Meta stated. The platform is coordinating with the SwapNet team, which has temporarily disabled the affected contracts. As a precaution, users were urged to immediately revoke approvals to individual aggregators outside of 0x's One-Time Approval framework, specifically highlighting SwapNet's router contract (0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e).
The incident underscores a persistent trade-off in DeFi between convenience and security. Unlimited token approvals, while user-friendly, create enduring attack surfaces. SwapNet has not yet released a full technical post-mortem or indicated plans for user compensation, raising questions about accountability.
This exploit occurred alongside another significant security incident flagged on the same day, where an unverified, closed-source Ethereum contract was exploited for over $3.1 million worth of WBTC. Together, these events highlight ongoing vulnerabilities in DeFi related to unverified code, persistent approvals, and complex routing layers.
