What happened
In January 2022, a flaw in Multichain's legacy Anyswap Router V5 *WithPermit flow let a fake token contract satisfy a permit call without granting a valid permit. Attackers used the router's pre-existing approval from affected wallets to transfer real WETH and other assets to attacker-controlled contracts. Multichain patched affected contracts, but users who had already approved the router needed to revoke those approvals; several wallets were drained after the public alert.
The permit-enabled router flow accepted a successful low-level permit call as evidence of authorization even when a token's fallback returned without implementing permit semantics.
Case & protocol details
Attack Timeline
The vulnerable depositWithPermit and router *WithPermit paths assumed a token's permit call would revert when it was unsupported. Some affected underlying tokens instead exposed a non-reverting fallback, so the call appeared successful without producing a valid authorization. An attacker deployed a fake underlying-token contract and called anySwapOutUnderlyingWithPermit, setting a victim with an existing router approval as from, the fake contract as token, and the victim's approved balance as amount.
The router then transferred the victim's genuine assets through its pre-existing allowance. The liquidity-pool contracts were upgraded promptly, but prior router approvals were user-controlled and could only be revoked by the wallet owner.
Funds Recovery
Recovered
$2.5M
Net Loss
$204,481
Evidence & learning
Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.