What happened
A January 2026 exploit affected Aperture Finance V3/V4 deployments across Ethereum, Arbitrum, Base, and BNB Chain. Security researchers attributed the incident to arbitrary external-call behavior that attackers used to abuse token approvals already granted to Aperture contracts. Public estimates place the loss at about $3.67 million.
Insufficient validation of an externally callable target and calldata created an arbitrary-call primitive. In a system that holds user token approvals, such a primitive can be converted into unauthorized transferFrom calls unless the destination, selector, and authorization context are all strictly constrained.
How it happened
- The affected V3/V4 contracts exposed a call path whose target and calldata were not constrained tightly enough.
- According to BlockSec's analysis, an attacker could direct that path to invoke token transferFrom operations against users who had approved the Aperture contracts.
- This made pre-existing allowances the practical source of the drain: the attacker did not need each victim to sign a new transaction during the incident.
- The affected contract versions existed on several EVM networks, so the issue was not limited to one pool or chain.
- Aperture subsequently warned users to revoke affected approvals and moved to replace the vulnerable deployments.
Protocol details
Security review history
- Oak Security View report
- Veridise View report
Evidence
- report Aperture Finance security incident analysis x.com
- report @PeckShieldAlert incident report x.com
- report BlockSec: $17M Closed-Source Smart Contract Exploit blocksec.com
- transaction Base exploit transaction basescan.org
- transaction Representative Aperture exploit transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis BlockSec: January 25–February 1, 2026 incident roundup blocksec.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
