SwapNet (Matcha Meta integration) — Arbitrary Call Approval Drain

Timeline: On 25 January 2026 at 17:10 UTC (~5:10 PM London time), the attack started on Base, block 41289829. Root cause: SwapNet's 0x87395540() function lacks proper validation on critical inputs. The attacker replaced expected router/pool addresses with token addresses (e.g. USDC), tricking the victim contract into treating tokens as valid execution targets. Low-level calls executed with attacker-controlled calldata, draining approved assets. Around 17:55 UTC (T+45min), SwapNet paused Base contracts, then all other chains shortly after. During the window: 17 additional users affected across 3 chains. At 21:47 GMT, Matcha Meta confirmed the incident on X and identified SwapNet as the cause. PeckShield (initial): $16.8M; Matcha Meta post-mortem confirmed $13.43M (the $3.4M delta was a separate Aperture Finance incident). Largest single-user loss: $13.34M. On 26-27 January, Matcha Meta removed SwapNet from its platform, disabled the One-Time Approval toggle. Weilin Li (DeFi security researcher, PhD student at University College London) stated on X: 'This is the largest approval attack (excluding phishing) I've ever seen.' Arbitrary call vulnerability — 1 user lost $13.34M in infinite approval.