BlockSec releases analysis of major closed-source contract vulnerabilities: SwapNet and Aperture Finance suffer $17 million loss due to insufficient input validation.

BlockSec released an analysis of a major closed-source contract vulnerability, detecting a series of suspicious transactions targeting SwapNet and Aperture Finance contracts deployed on Ethereum, Arbitrum, Base, and BSC, resulting in total losses exceeding $17 million. Fundamentally, both incidents stemmed from a simple vulnerability: the victim contracts suffered from insufficient input validation, leading to arbitrary call vulnerabilities. Attackers could exploit this vulnerability to abuse existing token authorization, thereby using transferFrom to steal assets. While the SwapNet and Aperture Finance incidents affected different protocols and blockchains, the underlying problem remains uncomplicated: user-controlled underlying calls and insufficient input validation within contracts holding token authorization.