BlockSec releases analysis of major vulnerabilities in closed-source contracts: SwapNet and Aperture Finance suffer attacks due to insufficient input validation, resulting in a loss of $17 million

Odaily Planet Daily reports that BlockSec has released an analysis of a major vulnerability in closed-source contracts. They detected a series of suspicious transactions targeting victim contracts deployed on SwapNet and Aperture Finance on Ethereum, Arbitrum, Base, and BSC, with total losses exceeding $17 million. Essentially, the root cause of these two incidents is simple: the victim contracts have reentrancy vulnerabilities due to insufficient input validation, allowing attackers to abuse existing token approvals to perform transferFrom and steal assets.

Although the SwapNet and Aperture Finance incidents affected different protocols and blockchains, their fundamental issues are not complex: underlying calls controlled by users, and insufficient input validation in contracts holding token approvals.