What happened
On 11 October 2022, an exploit in Rabby Swap's router contract let an attacker use approvals previously granted by Swap users to transfer assets without the owners' intended authorization. The affected component was the Rabby Swap smart contract, not users who had never used the Swap feature or a compromise of the Rabby wallet client.
The router did not sufficiently constrain the target contract and calldata of an external call. When a contract holds user approvals, uncontrolled downstream calls can turn those approvals into arbitrary transferFrom authority.
Case & protocol details
Attack Timeline
Reporting described a router path that accepted attacker-controlled external-call parameters without adequate validation. The attacker directed the router to make calls that consumed existing user token approvals, then moved assets across chains. Contemporary accounts tracked about 114 ETH and 179 BNB, aligning with the roughly $194,500 incident figure.
Rabby advised users who had used Swap to revoke the router approvals. Any router holding user approvals must restrict downstream calls to narrowly scoped, trusted targets and selectors.
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.