What happened
Zapper disclosed a vulnerability in its deprecated Ethereum-to-Polygon Bridge Zap. Accounts that had granted the contract unlimited ERC-20 allowances were at risk because the Zap could execute unvalidated external calldata. Zapper and whitehats conducted a rescue; a mempool bot front-ran part of it but returned the intercepted assets for distribution.
The ZapBridge path made low-level external calls using caller-supplied target addresses and calldata without validating the permitted target or selector. Its emergency-stop protection did not cover that path, so it could not be paused. The arbitrary-call capability could consume users’ existing unlimited token allowances via transferFrom.
Case & protocol details
Attack Timeline
The deprecated bridge accepted a caller-selected swap target and arbitrary calldata for external integrations. This let a caller invoke an ERC-20 transferFrom against wallets that had previously granted the bridge unlimited allowance. Zapper and the disclosing whitehats swept affected funds to a distribution contract; a generalized mempool bot copied and front-ran part of the rescue before returning the assets.
Funds Recovery
Recovered
$2.5M
Net Loss
$0
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.