{"investigation":{"slug":"matcha","entity_name":"Matcha","trust_score":62,"severity_base":null,"score_modifier":-10,"confidence":1,"status":"published","content_type":"investigation","summary":"Matcha (matcha.xyz) is a DEX aggregator built and operated by 0x Labs, launched in 2020, that routes trades across 130+ liquidity sources on 15+ blockchains using the 0x Protocol. The core Matcha platform has no history of direct exploits; however, Matcha Meta — a related but distinct meta-aggregator product launched later by the same team — suffered a $13.4M exploit in January 2026 via a third-party SwapNet contract, affecting users who had disabled the platform's default one-time approval security setting. 0x Labs is a well-funded, established entity whose protocol contracts have been audited by Trail of Bits, OpenZeppelin, and Ouroboros, and whose bug bounty program offers up to $1M via Immunefi.","sections":[{"content":"Matcha is a decentralized exchange (DEX) aggregator developed by 0x Labs, a blockchain infrastructure company founded in 2016 by Will Warren (co-founder and CEO) and Amir Bandeali (co-founder and CTO). Warren previously conducted research at Los Alamos National Laboratory and held a partial PhD in Structural Engineering from UC San Diego. Bandeali is a former fixed-income trader at DRW and a University of Illinois graduate. Matcha launched in April 2020 as a consumer-facing trading frontend built on top of the 0x Protocol, initially supporting Ethereum. The platform was among the first DEX aggregators to implement smart order routing — algorithmically splitting trades across multiple liquidity sources to minimize slippage. 0x Labs raised $70M in a Series B round in April 2022 led by Greylock, with participation from Pantera Capital, Jump Crypto, Coinbase, OpenSea, Brevan Howard, Reid Hoffman, Sound Ventures, and A.Capital, bringing total known funding to approximately $86.9M.","heading":"Background","sources":[{"url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure","name":"","type":"other","credibility":3},{"url":"https://matcha.xyz/about-matcha-dex-aggregator","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/05/24/0x-labs-releases-latest-version-of-dex-aggregator-matcha","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Matcha operates as a DEX aggregator, meaning it does not maintain its own liquidity pools but instead queries and routes trades across external liquidity sources. Using the 0x Swap API, the platform sources prices from 130+ on-chain and off-chain liquidity venues including Uniswap, SushiSwap, Curve, Balancer, and private market makers via the 0x RFQ (Request for Quote) system. Smart order routing splits individual trades into multiple sub-orders routed through different venues to achieve better execution prices and reduced slippage. As of 2025, Matcha supports over 9 million tokens across more than 15 blockchains, including Ethereum, Base, BNB Chain, Polygon, Arbitrum, Optimism, Avalanche, and Solana. Cross-chain swaps became available in December 2023. By default, Matcha uses a Permit2-based one-time approval system, which limits the scope of any token approval to the single transaction being executed rather than granting ongoing contract-level access to user funds. This security design is central to understanding the exposure that arose with the related Matcha Meta product. MEV (maximal extractable value) protection is built into routing through 0x's Swap API. Gas fees are embedded into quoted trade prices, eliminating the need for users to hold native gas tokens on some chains. As of mid-2025, Matcha reported routing over $3.9 billion in weekly volume and providing the best swap price 93% of the time relative to competing aggregators.","heading":"Protocol Mechanics","sources":[{"url":"https://blog.matcha.xyz/article/permit2","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/349429/0x-dex-aggregator-matcha-solana-cross-chain-avoid-memecoin-rug-pulls","name":"","type":"other","credibility":3},{"url":"https://0x.org/case-studies/matcha-v2","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The core Matcha.xyz platform has no known direct exploits as of May 2026. The primary protocol-level security incident in 0x's history occurred in July 2019, when researcher samczsun disclosed a critical vulnerability in the 0x v2.0 Exchange contract. The flaw involved improper handling of the WalletSignature type through inline assembly, allowing an attacker to bypass signature verification and fill orders at artificially low prices. The 0x team shut down the v2.0 Exchange contract within hours of disclosure, patched the code, and redeployed. No funds were lost. A related but distinct product, Matcha Meta (accessible at meta.matcha.xyz), suffered a significant exploit on January 26, 2026. Matcha Meta functions as a meta-aggregator — it queries other aggregators including SwapNet — rather than routing directly to DEX venues. An attacker exploited an arbitrary call vulnerability in SwapNet's router contract (0x616000e384Ef1C2B52f5f3A88D57a3B64F23757e) on the Base network. The attack targeted users of Matcha Meta who had manually disabled the platform's default one-time approval setting and instead granted persistent (infinite) token approvals directly to SwapNet's contracts. Approximately $13.43M was drained from 18 users; one user alone lost approximately $13.34M. On Base, roughly 10.5M USDC was swapped for 3,655 ETH and bridged to Ethereum. Third-party estimates initially cited $16.8M in losses, but Matcha Meta clarified that approximately $3.4M of that figure was attributable to a separate, unrelated Aperture Finance incident. Matcha Meta and 0x confirmed their own smart contracts were not compromised. SwapNet paused all contracts within 45 minutes of the exploit beginning. Matcha Meta subsequently removed SwapNet as an available aggregator and disabled the ability for users to turn off the one-time approval feature. This incident is distinct from the core Matcha.xyz product, though both are operated by 0x Labs and share branding. Users of Matcha.xyz who never interacted with Matcha Meta or SwapNet were not affected. 0x v2's smart contracts have undergone four formal audits from three firms: Ouroboros, Trail of Bits (twice), and OpenZeppelin. A live bug bounty program via Immunefi offers up to $1M for critical vulnerabilities in 0x Settler smart contracts, the Swap API, Gasless API, and the Matcha website.","heading":"Security History","sources":[{"url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/matcha-meta-swapnet-defi-exploit-loss/","name":"","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/","name":"","type":"other","credibility":3},{"url":"https://samczsun.com/the-0x-vulnerability-explained/","name":"","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe","name":"","type":"other","credibility":3},{"url":"https://0x.org/post/0x-v2-bug-bounty-program","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Matcha is developed and operated by 0x Labs, headquartered in San Francisco. Co-founder and CEO Will Warren holds a B.S. in Mechanical Engineering from UC San Diego and conducted materials research at Los Alamos National Laboratory before co-founding 0x. Co-founder Amir Bandeali previously worked as a fixed-income trader at DRW. The company was incorporated in 2017 and has grown to a multi-chain infrastructure provider. 0x Labs has raised a total of approximately $86.9M across funding rounds, with the $70M Series B in April 2022 being the most significant. No regulatory actions, SEC enforcement proceedings, DOJ investigations, or fraud allegations have been identified against 0x Labs or its named executives as of May 2026. The company's terms of service note that the 0x protocol is not registered with the CFTC, SEC, FinCEN, or other financial regulatory authorities, which is standard language for non-custodial DeFi protocols operating in a regulatory gray area.","heading":"Team (0x Labs)","sources":[{"url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure","name":"","type":"other","credibility":3},{"url":"https://www.crunchbase.com/organization/0x-project","name":"","type":"other","credibility":3},{"url":"https://0x.org/legal/terms-of-service","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The core Matcha.xyz DEX aggregator presents a low-to-moderate risk profile for a DeFi protocol of its age and scale. Its smart contracts (0x Settler, AllowanceHolder, Permit2 integration) have undergone four audits by established firms including Trail of Bits and OpenZeppelin, and an active Immunefi bug bounty program is in place. The default one-time approval model via Permit2 significantly limits user exposure relative to protocols relying on persistent ERC-20 allowances. The January 2026 SwapNet exploit that drained $13.4M from Matcha Meta is a significant event but applies specifically to Matcha Meta users who had disabled the one-time approval feature — not to Matcha.xyz users or users who retained default settings. The incident does, however, highlight risks inherent in meta-aggregation architectures where exposure is introduced by third-party aggregator contracts. 0x Labs' response was prompt: SwapNet was removed, the user-facing toggle that permitted persistent approvals was disabled, and a post-mortem was published. Brand confusion between Matcha.xyz and Matcha Meta represents an ongoing reputational and user-safety risk: users may conflate the two products and misjudge their actual risk exposure. No evidence of rug pull characteristics, anonymous team, unaudited contracts, or regulatory enforcement actions was identified. The platform has operated for over five years with significant institutional backing and measurable on-chain volume, which are positive trust indicators. Key residual risks: smart contract complexity across 15+ chains, third-party liquidity source risk (as demonstrated by the SwapNet incident), and regulatory uncertainty common to all non-custodial DeFi protocols.","heading":"Risk Assessment","sources":[{"url":"https://0x.org/docs/developer-resources/bounties","name":"","type":"other","credibility":3},{"url":"https://cryptopolitan.com/matcha-meta-security-breach-16-8m-drained/","name":"","type":"other","credibility":3},{"url":"https://www.livebitcoinnews.com/matcha-meta-removes-direct-allowances-after-16-8m-swapnet-exploit-as-crypto-hacks-rise/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2016","event":"0x Labs founded by Will Warren and Amir Bandeali in San Francisco.","source":"","date_original":"2016-01-01"},{"date":"2018","event":"0x Protocol v1 launches on Ethereum mainnet, enabling peer-to-peer token exchange via off-chain order books and on-chain settlement.","source":"","date_original":"2018-01-01"},{"date":"2019-07-12","event":"Critical vulnerability disclosed in 0x v2.0 Exchange contract by researcher samczsun, allowing signature bypass. 0x team shuts down contracts within hours; no funds lost.","source":""},{"date":"2020-04","event":"Matcha launches in closed beta as a DEX aggregator frontend built on 0x Protocol.","source":"","date_original":"2020-04-01"},{"date":"2020-06","event":"Matcha opens to the public with gas-free trades and smart order routing across 15 DEXs.","source":"","date_original":"2020-06-01"},{"date":"2022-04-26","event":"0x Labs raises $70M Series B led by Greylock, with participation from Pantera Capital, Jump Crypto, Coinbase, and others.","source":""},{"date":"2023-05-24","event":"Matcha v2 launches with multi-chain support including Ethereum, BNB Chain, and Polygon.","source":""},{"date":"2023-12","event":"Cross-chain swap functionality launches on Matcha.","source":"","date_original":"2023-12-01"},{"date":"2024-07","event":"0x Labs launches bug bounty program via Immunefi for 0x v2, offering up to $1M for critical vulnerabilities.","source":"","date_original":"2024-07-01"},{"date":"2025","event":"Matcha expands to Solana, becoming one of the first DEX aggregators to support both SVM and EVM chains in a single app.","source":"","date_original":"2025-01-01"},{"date":"2026-01-26","event":"Matcha Meta (meta.matcha.xyz) suffers $13.4M exploit via a vulnerability in integrated third-party SwapNet router contract. 18 users affected; those who had disabled the default one-time approval setting were exposed. 0x Labs' own contracts were not compromised.","source":""},{"date":"2026-01-27","event":"Matcha Meta removes SwapNet as an available aggregator, disables the toggle allowing users to turn off one-time approvals, and publishes post-mortem.","source":""}],"sources_used":[{"url":"https://www.businesswire.com/news/home/20220426006160/en/0x-Labs-Raises-%2470M-Led-By-Greylock-to-Continue-Expanding-Web3s-Core-Exchange-Infrastructure","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://matcha.xyz/about-matcha-dex-aggregator","name":"","type":"other","archive_url":"http://web.archive.org/web/20260719014558/https://matcha.xyz/about-matcha-dex-aggregator","credibility":3,"archive_timestamp":"2026-07-19T01:45:58+00:00"},{"url":"https://www.coindesk.com/business/2023/05/24/0x-labs-releases-latest-version-of-dex-aggregator-matcha","name":"","type":"other","archive_url":"https://web.archive.org/web/20260915164547/https://www.coindesk.com/business/2023/05/24/0x-labs-releases-latest-version-of-dex-aggregator-matcha","credibility":3,"archive_timestamp":"2026-09-15T16:45:47+00:00"},{"url":"https://blog.matcha.xyz/article/permit2","name":"","type":"other","archive_url":"http://web.archive.org/web/20260417190224/https://blog.matcha.xyz/article/permit2","credibility":3,"archive_timestamp":"2026-04-17T19:02:24+00:00"},{"url":"https://www.theblock.co/post/349429/0x-dex-aggregator-matcha-solana-cross-chain-avoid-memecoin-rug-pulls","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://0x.org/case-studies/matcha-v2","name":"","type":"other","archive_url":"http://web.archive.org/web/20260611164759/https://0x.org/case-studies/matcha-v2","credibility":3,"archive_timestamp":"2026-06-11T16:47:59+00:00"},{"url":"https://www.theblock.co/post/386986/matcha-meta-swapnet-incident","name":"","type":"other","archive_url":"http://web.archive.org/web/20260206213231/https://www.theblock.co/post/386986/matcha-meta-swapnet-incident","credibility":3,"archive_timestamp":"2026-02-06T21:32:31+00:00"},{"url":"https://beincrypto.com/matcha-meta-swapnet-defi-exploit-loss/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260126115206/https://beincrypto.com/matcha-meta-swapnet-defi-exploit-loss/","credibility":3,"archive_timestamp":"2026-01-26T11:52:06+00:00"},{"url":"https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260617144908/https://www.dlnews.com/articles/defi/matcha-meta-users-lose-millions-after-security-breach-at-integrated-protocol/","credibility":3,"archive_timestamp":"2026-06-17T14:49:08+00:00"},{"url":"https://samczsun.com/the-0x-vulnerability-explained/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260524214209/https://samczsun.com/the-0x-vulnerability-explained/","credibility":3,"archive_timestamp":"2026-05-24T21:42:09+00:00"},{"url":"https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe","name":"","type":"other","archive_url":"http://web.archive.org/web/20260312231355/https://cointelegraph.com/news/0x-dex-protocol-suspended-because-of-vulnerability-funds-safe","credibility":3,"archive_timestamp":"2026-03-12T23:13:55+00:00"},{"url":"https://0x.org/post/0x-v2-bug-bounty-program","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516150704/https://0x.org/post/0x-v2-bug-bounty-program","credibility":3,"archive_timestamp":"2026-05-16T15:07:04+00:00"},{"url":"https://www.crunchbase.com/organization/0x-project","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://0x.org/legal/terms-of-service","name":"","type":"other","archive_url":"http://web.archive.org/web/20260516151126/https://0x.org/legal/terms-of-service","credibility":3,"archive_timestamp":"2026-05-16T15:11:26+00:00"},{"url":"https://0x.org/docs/developer-resources/bounties","name":"","type":"other","archive_url":"http://web.archive.org/web/20251212065049/https://0x.org/docs/developer-resources/bounties","credibility":3,"archive_timestamp":"2025-12-12T06:50:49+00:00"},{"url":"https://cryptopolitan.com/matcha-meta-security-breach-16-8m-drained/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260207081039/https://www.cryptopolitan.com/matcha-meta-security-breach-16-8m-drained/","credibility":3,"archive_timestamp":"2026-02-07T08:10:39+00:00"},{"url":"https://www.livebitcoinnews.com/matcha-meta-removes-direct-allowances-after-16-8m-swapnet-exploit-as-crypto-hacks-rise/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260127193435/https://www.livebitcoinnews.com/matcha-meta-removes-direct-allowances-after-16-8m-swapnet-exploit-as-crypto-hacks-rise/","credibility":3,"archive_timestamp":"2026-01-27T19:34:35+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:18.982329+00:00","updated_at":"2026-09-15T17:10:50.026204+00:00"}}