A series of exploits has renewed attention on persistent ERC-20 approvals and the contracts authorized to spend them. BonfireSwap, Ekubo and a legacy ether.fi withdrawal component were exploited through different authorization or parsing failures that turned existing user allowances into attack surfaces, showing how an approval can remain dangerous long after the transaction that originally required it.
The clearest documented example comes from Ekubo. According to the protocol’s official Huff router post-mortem, a calldata parsing bug allowed attackers to replace the address from which tokens should be pulled with any account that had previously approved the router. The May 5 incident affected 31 addresses and caused approximately $1.42 million in losses.
Stale Approvals Expand the Attack Surface
BonfireSwap suffered a similar outcome through a simpler access-control failure on BNB Chain. Its router failed to verify that the caller was authorized to spend tokens belonging to the supplied source address, allowing an attacker to force-sell BONFIRE held by wallets with standing approvals. The attack swept roughly 65 approved addresses, while SlowMist reported 41 affected holders and losses near 66 BNB.
Ekubo’s flaw operated differently. Its Huff router calculated settlement data from the logical end of a decoded route instead of the actual end of calldata, allowing appended bytes to redefine values including the source wallet. Four immutable router deployments remain vulnerable at contract level, although Ekubo has stopped routing through them, whitehatted finite approvals and warns users who still maintain infinite allowances.
A September incident involving ether.fi showed how deprecated infrastructure can retain similar exposure. An old Veda AtomicQueue contract allowed callers to provide an arbitrary solver address without verifying that the solver had authorized the transaction, enabling an attacker to exploit leftover approvals from 11 wallets. Approximately 14.45 liquidETH and a small amount of USDC were taken and converted into about 15.45 ETH.
The current ether.fi vault architecture was not compromised. The vulnerable AtomicQueue had already been deprecated, but historical approvals remained active on-chain, illustrating why retiring an application interface does not automatically eliminate the permissions users previously granted to its contracts. Ether.fi CEO Mike Silagadze said affected wallets would be reimbursed.
Not Every Module Exploit Is an Approval Bug
A separate $7.8 million rsETH incident involving a Gnosis Safe reinforces the broader infrastructure risk but had a different root cause. A public batch contract could be made to trust itself and reach modules already enabled by the Safe, ultimately moving about 2,900 aEthrsETH without a new owner signature. An MEV searcher known as Yoink reached the execution path before the original attacker.
Early descriptions linked that drain to malicious Uniswap v4 hook logic, but later transaction tracing found the relevant pool used a zero-address hook and behaved as an ordinary v4 pool. The vulnerability instead sat in the authorization path connecting the public executor, trusted module and Safe.
The common operational lesson is therefore narrower than saying ERC-20 approvals themselves are broken. Standing allowances become dangerous when the contract holding spending authority contains exploitable authorization, parsing or execution logic, and those permissions can survive for years unless users revoke them. The immediate security priority for protocols is to monitor outstanding approvals to deprecated contracts, while users should remove allowances to routers and modules they no longer use.
Natalie Pierce tracks the parts of crypto that move fast and rarely wait for everyone to catch up. From South Africa, she covers DeFi, AI crypto, hacks, airdrops, sentiment and emerging narratives, especially when user behavior and protocol risk start to overlap.
Her reporting is built for messy sectors. Natalie looks at incentives, reactions, security concerns, social momentum and early signs of traction without pretending every new trend is already proven. Her voice is clear and accessible, but careful enough for areas where excitement can outrun the facts very quickly.