What happened
A January 2026 exploit affected Aperture Finance V3/V4 deployments across Ethereum, Arbitrum, Base, and BNB Chain. Security researchers attributed the incident to arbitrary external-call behavior that attackers used to abuse token approvals already granted to Aperture contracts. Public estimates place the loss at about $3.67 million.
Insufficient validation of an externally callable target and calldata created an arbitrary-call primitive. In a system that holds user token approvals, such a primitive can be converted into unauthorized transferFrom calls unless the destination, selector, and authorization context are all strictly constrained.
Case & protocol details
Attack Timeline
The affected V3/V4 contracts exposed a call path whose target and calldata were not constrained tightly enough. According to BlockSec's analysis, an attacker could direct that path to invoke token transferFrom operations against users who had approved the Aperture contracts. This made pre-existing allowances the practical source of the drain: the attacker did not need each victim to sign a new transaction during the incident.
The affected contract versions existed on several EVM networks, so the issue was not limited to one pool or chain. Aperture subsequently warned users to revoke affected approvals and moved to replace the vulnerable deployments.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- report BlockSec: $17M Closed-Source Smart Contract Exploit blocksec.com
- transaction Transaction basescan.org
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.