Matcha Swap After the Approval Reset
The detail that made the January incident make sense was the toggle. It was not merely hidden in a redesign; Matcha removed the option to disable One-Time Approval. Every transaction now routes through the AllowanceHolder contract, and SwapNet has been removed from Matcha Meta until further notice.
That changes the operating model for anyone who has been trading through Matcha routinely. Before, experienced users could choose the direct aggregator path and grant an approval suited to their own workflow. That flexibility also created the failure mode: on January 25, 2026, users who disabled One-Time Approval and granted infinite approval directly to SwapNet contracts were exposed during the exploit.
The post-mortem puts the affected group at 18 users and the loss at $13.43 million. One wallet accounted for roughly $13.34 million. The important distinction is not the headline number; it is the condition that produced it. Users who stayed with the default One-Time Approval setting were not exposed in that way.
What the new default changes
The practical gain is fewer approval decisions at the point where speed usually wins. You no longer need to remember whether a particular route is using the safer allowance flow, and you cannot accidentally turn that protection off inside Matcha Meta. For a regular swap, the transaction path is now more constrained by design.
The trade-off is real. If your process depended on direct access to an aggregator, custom allowance behavior, or a route that SwapNet supplied, that process is gone for now. A failed quote or missing route is no longer something to solve by flipping the old setting; you need to change the route, reduce the size, or wait for liquidity elsewhere.
That makes pre-trade checking more important, not less. Compare the quoted receive amount with the wallet balance you expect to approve, inspect the spender before signing, and treat a newly requested unlimited allowance as a workflow interruption. The new default removes one class of user error, but it does not make a bad token, thin liquidity, or a malicious contract harmless.
For the actual transaction, matcha swap is the place to inspect the current route and allowance flow yourself. The useful change is not that every trade becomes identical; it is that the most security-sensitive choice is no longer left exposed as an easy optimization.