CoW Swap Hack

Reported loss $180K
Ethereum
Other

What happened

On February 7, 2023, attackers took about $180,000 from CoW Swap after a SwapGuard contract used by the Barter Solver was approved to move settlement funds. The vulnerable interaction path allowed arbitrary calls, enabling an attacker-controlled contract to obtain token-transfer approval and move DAI from the settlement contract.

How it happened

  1. The Barter Solver's SwapGuard contract held approval to move funds from CoW's settlement system.
  2. The attacker used the vulnerable interaction path to make the settlement contract approve an attacker-controlled contract.
  3. That contract transferred DAI from the GPv2Settlement contract, producing an approximately $180,000 loss.
  4. The source attributes the failure to arbitrary calls and missing validation of the interaction data.

Protocol details

Classification Exchange (DEX) / Access Control
Protocol Type Exploit/Other
Implementation language Solidity
Protocol links Website @CoWSwap

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks Delegatecall & Call Injection Attacks

Same attack technique

Browse all hacks →
Ethereum Aave $56K lost BNB Chain Chainge Finance $716K lost Ethereum BasketDAO $1.2M lost Ethereum Brahma Finance $90K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes