Matcha Meta
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 28 → 58. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −6, problems around the subject, caused by others −1.1; legitimacy credit long-running +10; the penalty for incidents it suffered is capped at 20. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.1 |
| Long-running | +10 |
| Sum | 48 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 58/100 (kept between 0 and 100)
How scoring works →Summary
Matcha Meta is a DEX meta-aggregator built on the 0x protocol by 0x Labs, launched in 2020, that routes trades across 140+ DEXs on 10+ blockchains. On January 25, 2026, a vulnerability in the SwapNet routing module — an integrated third-party liquidity provider — was exploited via an arbitrary external call flaw, draining open token allowances from users who had disabled the platform's default One-Time Approval feature. PeckShield reported initial losses of approximately $16.8M; Matcha Meta's post-mortem confirmed $13.43M in net losses across 20 affected users, with the balance attributable to a separate, concurrent $3.4M Aperture Finance exploit. Users with persistent approvals to SwapNet contracts face ongoing residual exposure until those allowances are revoked.
Connected Entities
6 entities · 60 linked investigations- Binance→mentioned with→Ethereum(65%)
- Matcha→mentioned with→Binance(65%)
- Matcha→mentioned with→Matcha Meta(80%)
- Arbitrum→mentioned with→Binance(65%)
- Matcha→mentioned with→Arbitrum(60%)
- Matcha→mentioned with→Ethereum(80%)
- Matcha→mentioned with→Base(70%)
- Matcha Meta→mentioned with→Binance(60%)
- Matcha Meta→mentioned with→Arbitrum(65%)
- Matcha Meta→mentioned with→Matcha(70%)
- + 4 more
1 submission awaiting moderator review.
Timeline(6 events)
April 2020
Matcha launched by 0x Labs as a DEX aggregator interface, aggregating liquidity across multiple DEXs on Ethereum.
0x Labs / matcha.xyz official25 January 2026
SwapNet router contract exploit begins at approximately 5:10 PM London time. Attacker exploits arbitrary call vulnerability in function 0x87395540() to drain open token allowances from users who disabled One-Time Approvals. Approximately $10.5M USDC swapped for ~3,655 ETH on Base network.
PeckShieldAlert on X; Matcha Meta post-mortem25 January 2026
At approximately 9:47 PM London time, Matcha Meta publicly acknowledges the security incident on X, urging users to revoke approvals to SwapNet contracts. PeckShield reports $16.8M in losses.
PeckShieldAlert on X; DL News25 January 2026
Aperture Finance, a separate multi-chain liquidity protocol, also suffers an exploit using a functionally identical arbitrary-call vulnerability on the same date, accounting for an additional ~$3.4-3.67M in losses tracked within the broader $16.8M PeckShield estimate.
Cryptopolitan; BlockSec Blog26 January 2026
Matcha Meta publishes official post-mortem confirming $13.43M in net SwapNet-specific losses across 20 users, exonerating 0x core contracts. Protocol permanently removes the direct allowance option from its interface.
Matcha Meta SwapNet Incident Post Mortem5 February 2026
Aperture Finance separately confirms $3.67M in losses from the January 25 exploit, corroborating the concurrent nature of the two incidents.
BeInCrypto; BlockSec BlogDecision Log
- slot 455363908 · hash 4qcGm52WHDhuL9irAYrmAkdk3ysaFZb1g64pvh6c57xW
- slot 422349703 · hash 8RPJn8gAC4XACNWWM86JPAtvagbU6gESaDe1NA4K6iDL
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 13 of 14 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/26/2026, 7:42:36 PM
last updated: 10/10/2026, 6:44:17 PM
3 viewsavoid.net — verified advice for a post-truth world