Multichain Hack

Reported loss $2.7M
Ethereum BNB Chain Polygon Avalanche Fantom
Non-reverting fallback bypass of permit validation

What happened

In January 2022, a flaw in Multichain's legacy Anyswap Router V5 *WithPermit flow let a fake token contract satisfy a permit call without granting a valid permit. Attackers used the router's pre-existing approval from affected wallets to transfer real WETH and other assets to attacker-controlled contracts. Multichain patched affected contracts, but users who had already approved the router needed to revoke those approvals; several wallets were drained after the public alert.

Technical root cause

The permit-enabled router flow accepted a successful low-level permit call as evidence of authorization even when a token's fallback returned without implementing permit semantics.

How it happened

  1. The vulnerable depositWithPermit and router *WithPermit paths assumed a token's permit call would revert when it was unsupported.
  2. Some affected underlying tokens instead exposed a non-reverting fallback, so the call appeared successful without producing a valid authorization.
  3. An attacker deployed a fake underlying-token contract and called anySwapOutUnderlyingWithPermit, setting a victim with an existing router approval as from, the fake contract as token, and the victim's approved balance as amount.
  4. The router then transferred the victim's genuine assets through its pre-existing allowance.
  5. The liquidity-pool contracts were upgraded promptly, but prior router approvals were user-controlled and could only be revoked by the wallet owner.

Protocol details

Classification Permit validation failure in a legacy approval-drain router
Protocol Type Bridge
Implementation language Solidity
Protocol links Website @MultichainOrg
Exploit Transaction 0x2bbd6a6a0d4d56db0b…2acf1ee7a9

Security review history

Funds Recovery

92.5%

Recovered

$2.5M

Net Loss

$204,481

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes