Calldata Injection: The $17M Vulnerability Pattern Hiding in Every DeFi Router

The Pattern That Keeps Taking Money In January 2026, two DeFi protocols — SwapNet and Aperture Finance — lost a combined $17 million to the same vulnerability class: arbitrary calldata injection. Two months later, the z0r0z V4 Router (a community Uniswap V4 router) disclosed a similar flaw. The pattern is consistent: a contract holds user approvals and exposes a function that makes low-level calls with attacker-controlled data. This isn't a novel attack. It's a well-known anti-pattern that keeps shipping to production because teams don't validate call targets and selectors in aggregator and router contracts. Let's break down exactly how it works, why it's so deadly, and how to build contracts that are immune to it. The Anatomy of a Calldata Injection Attack The Setup DeFi routers and aggregators need broad permissions to function. Users approve tokens via ERC20.approve() or Permit2, granting the router contract the ability to move their tokens. This is by design — the router needs to p