On April 23, 2024, Magpie Protocol's MagpieRouterV2 was exploited for $129K affecting 221 wallets. The router validated selector presence but not position, allowing attackers to embed selectors in call data to bypass access controls.

The decentralized liquidity aggregation protocol Magpie Protocol was attacked due to a contract vulnerability, resulting in $129,000 being stolen from 221 wallets. The root cause is due to unchecked call data. The attacker called the contract's swap() function and passed in data which included a list of users to transfer tokens from.