Over the past 72 hours, the intent-based DEX aggregator 'SwapIntents' lost $2.1M in user funds. The exploit did not touch a single smart contract. No reentrancy, no oracle manipulation, no flash loan attack. The attack vector was a simple logic flaw in the off-chain solver network's reputation system. Code does not lie, only the documentation does. The documentation promised 'trustless intent fulfillment,' but the code revealed a centralized scoring engine that could be gamed by submitting orders that were never filled.
Intent-based architectures are the latest narrative in decentralized exchange design. Instead of users submitting transactions directly to a liquidity pool, they sign off-chain 'intents'—a specification of what they want to trade, at what price, and within what constraints. A network of solvers then competes to fulfill those intents, submitting the best execution path to a settlement contract. The promise is lower fees, better prices, and abstracted complexity. The reality, as SwapIntents demonstrated, is a new attack surface that traditional security audits systematically miss.
Context: The Solver Network Trust Model
SwapIntents launched in early 2026, promising a 'hybrid' model where solvers are permissioned but compete on reputation. Each solver node maintains a reputation score based on historical fill rates, latency, and slippage minimization. Users intents are broadcast to the network, and the solver with the highest reputation score at that moment gets priority to attempt fulfillment. If it succeeds, its reputation increases; if it fails or times out, reputation decreases. The key assumption is that the reputation system is tamper-proof because it is stored on-chain as a Merkle root. However, the scoring logic that determines who gets priority was computed off-chain by a central coordinator node.
Core: The Off-Chain Scoring Exploit
During my audit of a similar intent-based system in 2025, I warned that off-chain reputation engines introduce a deterministic failure point—they replace on-chain consensus with a single point of trust. SwapIntents' coordinator node computed reputation updates using a weighted average of past performance, with a weighting factor that decayed over time. The formula was: new_score = (0.7 1 recent_performance). The 'recent_performance' metric was derived from the solver's success rate over the last 100 intents. The vulnerability: the coordinator accepted signed intent receipts from solvers as proof of fulfillment, but it did not verify that the intents were actually settled on-chain. A malicious solver could submit intents to itself, generate fake receipts, and inflate its reputation score without ever touching a liquidity pool.
The exploit unfolded over three weeks. The attacker registered a solver node with a clean history. It then submitted small intents to itself, generating fake receipts. The coordinator accepted these receipts because it only checked the cryptographic signature of the solver, not the on-chain settlement proof. If it cannot be verified, it cannot be trusted. The attacker's reputation score rose steadily. By day 20, it had the highest reputation in the network. On day 21, it submitted a large intent from a whale user—a $2.1M USDC to ETH swap. The coordinator routed the intent to the attacker's solver. The solver then matched the intent with a fake liquidity provision, sending the USDC to its own wallet and never settling the ETH. The whale user received nothing. The coordinator's smart contract had no mechanism to reverse the settlement because the intent was technically 'fulfilled' according to the off-chain receipt.
What makes this case particularly instructive is that SwapIntents' on-chain smart contracts were audited by three reputable firms. The audits focused on the settlement contract, the token transfer logic, and the Merkle root verification. None of them examined the off-chain reputation engine because it was not part of the audit scope. The team assumed that the coordinator node was a trusted entity. Security is a process, not a feature. The process failed to include the off-chain component.
Contrarian: The Blind Spot of On-Chain Obsession
The industry has spent years obsessing over on-chain vulnerabilities—reentrancy, overflow, oracle manipulation. The SwapIntents incident reveals a more fundamental blind spot: the trust assumptions embedded in off-chain logic. Intent-based architectures inherently rely on a network of solvers that must be coordinated. That coordination can be permissionless (like a mempool) or permissioned (like a reputation system). Permissionless solvers suffer from MEV and frontrunning. Permissioned solvers suffer from reputation manipulation. Neither is a clean solution.
Proponents argue that intent-based designs will replace traditional DEXs because they offer 'better execution' and 'lower fees'. But the trade-off is clear: you are moving the MEV attack from on-chain miners to off-chain solver networks. The attack surface shifts, but it does not shrink. In fact, off-chain components are harder to audit because they are not deterministic. The coordinator node's behavior is not enforced by consensus; it is enforced by code that can be silently updated. The SwapIntents team could have patched the reputation engine without a hard fork, but that would have required a centralized decision. The irony is that the industry's push for 'decentralized' intent architectures is built on a foundation of centralized off-chain infrastructure.
Based on my experience in 2025 analyzing the integration of Chainlink CCIP with AI agent frameworks, I saw the same pattern: non-deterministic components introduced variance that could not be safely contained. We spent months building hybrid verification layers to detect outliers. The same principle applies here. Intent-based DEXs need a deterministic verification layer that independently confirms every solver action on-chain, not just the final settlement. The cost is higher latency and gas, but the alternative is $2.1M exploits.
Takeaway: The Market Will Not Wait for Deterministic Finality
SwapIntents has paused its solver network and hired a forensic firm. The damage is done, but the market reaction is telling. The token of the project dropped 40% in 24 hours, but trading volume on other intent-based aggregators spiked—traders are rotating, not abandoning. The narrative is still alive. However, the next exploit will be larger. The vulnerability is not a bug; it is a structural flaw in the design philosophy. Intent-based architectures will not replace DEXs until they achieve the same deterministic finality that on-chain settlement provides. Until then, they are just moving the attack surface. The question is not 'if' another solver network will be exploited, but 'when' and 'how much'. Verify everything. Trust nothing. The code does not lie, but the documentation will always tell a prettier story.