Incident Overview
Multichain Protocol encountered a front-run attack resulting in the loss of 147,326 $USD worth of $ETH
Multichain is an infrastructure designed to support arbitrary cross-chain interactions. On February 15, 2023, the AnyswapV4Router contract of Multichain encountered a front-run attack, during which the attacker made a profit of 87 $ETH, worth approximately 147,326 $USD at the moment.
The vulnerability occurred because the attacker used an MEV contract to front-run and invoke a function of the AnySwapV4Router contract to sign and approve the transfer. Due to the lack of signature verification, the attacker was able to transfer the $ETH approved to the victim contract, through the from address parameter directly to the attack contract using the safeTransferFrom() function.
This was an old vulnerability that was reported in January 2022 and more than 61% of all affected users had revoked access to the contract containing the underlying vulnerability. The liquidity pool's vulnerability was quickly fixed after it was reported, as the Multichain team upgraded the affected tokens' liquidity to new contracts.
Attacker address:
https://etherscan.io/address/0xfde0d157…81455a
Malicious MEV contract:
https://etherscan.io/address/0xd050e0a4…f3805d
Malicious transaction:
https://etherscan.io/tx/0x192e2f19…1be47f
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Multichain, these are the critical security checks that could have prevented this incident (February 2023).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Multichain
The Multichain hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.