Multichain Hack

On 15 February 2023 an MEV bot exploited an old vulnerability in Multichain's AnyswapV4Router on Ethereum and took 87 WETH from a user wallet that still had a WETH approval to the router. Coverage at the time valued it at about $130K to $147K.

The bug was the router's anySwapOutUnderlyingWithPermit() function. It calls permit() on the underlying token to check the owner's signature and then pulls the tokens with safeTransferFrom. WETH has no permit() function, but its fallback function accepts the call without reverting, so no signature was ever checked. Anyone could pass a victim's address as from and move WETH the victim had already approved to the router.

Dedaub reported this flaw to Multichain on 10 January 2022. Multichain fixed the liquidity pool issue by moving liquidity to new contracts, but approvals already given to the old router could only be removed by users themselves. By 18 February 2022 over 61% of the 7,962 affected addresses had revoked, and Multichain said it would not reimburse losses after that date. This wallet was one that never revoked.

The transaction was sent by 0xfde0d1575ed8e06fbf36256bcdfa1f359281455a, which Etherscan labels an MEV frontrunner, through contract 0xd050e0a4838d74769228b49dff97241b4ef3805d. The same transaction paid about 69.86 ETH to the block builder builder0x69, so the bot kept only part of the 87 WETH.