SwapNet Attack Analysis: $13.43M Lost to Arbitrary Call Vulnerability

On January 25, 2026, the SwapNet protocol was compromised by a hacker attack. Exploiting vulnerabilities in the SwapNet smart contracts, the attacker repeatedly launched the attack across multiple blockchains, resulting in approximately $13.43 million in asset losses ultimately.

The SwapNet protocol involved in this incident is a decentralized trading aggregation protocol that enables users to execute multi-step swap operations through its smart contracts for optimal trading routes. Similar to mainstream DEX Aggregators, the SwapNet smart contracts dynamically call different external contracts to complete asset swaps within a single transaction based on the parameters provided by users.

Attack Flow

Taking the attack that caused the largest losses as an example:

The attacker created the attack contract and invoked the 0x87395540() function of the contract at 0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e, with 13,342,433,169,249 USDC directly transferred to the SwapNet Exploiter.

Analysis of the Attack Logic

By observing the attacker's attack flow, it can be determined that the attacker input malicious parameters which were executed by the contract, resulting in the attacker directly extracting all assets that the victims had approved for the contract at 0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e.

The code logic for the aforementioned parameters is as follows:

0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913.transferFrom{
    0xba15E9b644685cB845aF18a738Abd40C6Bcd78eD,  // victim
    0x6cAad74121bF602e71386505A4687f310e0D833e,  // attacker
    13342433169249                                // amount
}

The contract lacked validation for:

• Legitimacy of the target address for external calls
• Whether the called function selector belongs to the expected interface
• Whether the calldata complies with business logic constraints

The attacker forged transaction path data in the parameters. The contract was supposed to call legitimate DEX Router or liquidity pool contracts, yet the attacker carefully constructed the input parameters to replace the address used for external calls within the contract with the USDC contract address.

Meanwhile, during the external call, the attacker manipulated the content of the calldata, resulting in the actual execution of the following operation:

transferFrom(victim, attacker, amount)

Resulting in large-scale financial losses.

Summary

The root cause of the SwapNet attack incident lies in the severe arbitrary call risk in the contract design. Since the contract failed to perform strict validation on the target address and calldata for external calls during the swap execution process, the attacker was able to hijack the contract's low-level call logic by constructing malicious parameters, and indirectly invoke the ERC20 contract to execute transferFrom, thereby stealing the assets of authorized users.

Recommendations