My routine swaps now start with one less decision: I leave One-Time Approval on, and Matcha no longer lets me turn it off.
That is the important recent change. On January 25, 2026, SwapNet contracts used by Matcha Meta were exploited. The affected path was specific: users who had disabled One-Time Approval and granted infinite approval directly to SwapNet. Eighteen users lost $13.43 million in total, including one wallet that lost about $13.34 million.
Matcha’s response was not a warning banner or another setting buried in preferences. It removed the choice. The toggle is disabled. Trades now route through the AllowanceHolder contract, and SwapNet has been removed from Matcha Meta until further notice.
For the actual swap, matchaswap is still the tab I use when I want the router to compare venues and show the amount that should reach my wallet. The change sits underneath that familiar flow: the approval is narrow, and the contract cannot keep a broad claim on the token balance after the intended spend.
What changed in the routine
The first trade with a token still has an approval step. That has not disappeared. What disappeared is the temptation to choose convenience over scope when a route or aggregator asks for access.
I used to check three things before signing: token, amount, and spender. The spender check still matters, but the approval mode now matters less because the risky option is gone from the product. That makes the sequence shorter without making it casual.
For a regular swap, I now do this:
- Choose the chain and pair.
- Read the quote’s minimum received amount, gas estimate, and route.
- Approve the token once, then sign the swap through the default path.
After settlement, I still check the transaction and review approvals for tokens I no longer use. One-Time Approval reduces the exposure. It does not remove slippage, malicious tokens, compromised wallets, or a bad signature from the list of things that can go wrong.
The useful part is the reduction in blast radius. If a trade interface or external contract is compromised later, a strict one-time allowance gives it less room to drain. That is a meaningful improvement for anyone making frequent small swaps, where approval hygiene otherwise becomes background maintenance.
What it opens up
This is less a new feature than a better floor for the features already there. Matcha can keep improving routing, large-order execution, cross-chain swaps, and its mobile workflow without asking experienced users to decide whether security should be weakened for speed.
That tradeoff used to be framed as flexibility. In practice, it made the safest path optional. Removing the toggle makes the default product opinionated in the right place.
It also changes how I think about large trades. Matcha’s newer pricing engine is built around 0x v2, with more than 122 liquidity sources and routing designed for trades from roughly $5,000 to $10 million. At that size, execution quality matters, but approval scope matters too. A better quote is not a better trade if the permission granted to obtain it is excessive.
The surviving habit is simple: compare the settled output, use the default approval path, and revoke old permissions occasionally. The recent change means the interface now does more of that risk control before I reach the wallet.