I'm working on a smart contract that uses 0xAPI data passed in by the user to execute a number of ERC20 swaps.
I noticed that the 'to' field of the
/swap/v1/quote response seems to always contain the address of the 0xExchangeProxy contract.
So I was wondering if I could hardcode this address in the contract to avoid potential attack vectors resulting from calling arbitrary contract addresses passed by the user.
In other words are there any circumstances (for ERC20 Token Trades) under which the 0xAPI will return a
to address other than above linked Proxy contract?