Multichain Hack

Multichain Protocol encountered a front-run attack resulting in the loss of 147,326 $USD worth of $ETH

Multichain is an infrastructure designed to support arbitrary cross-chain interactions. On February 15, 2023, the AnyswapV4Router contract of Multichain encountered a front-run attack, during which the attacker made a profit of 87 $ETH, worth approximately 147,326 $USD at the moment.

The vulnerability occurred because the attacker used an MEV contract to front-run and invoke a function of the AnySwapV4Router contract to sign and approve the transfer. Due to the lack of signature verification, the attacker was able to transfer the $ETH approved to the victim contract, through the from address parameter directly to the attack contract using the safeTransferFrom() function.

This was an old vulnerability that was reported in January 2022 and more than 61% of all affected users had revoked access to the contract containing the underlying vulnerability. The liquidity pool's vulnerability was quickly fixed after it was reported, as the Multichain team upgraded the affected tokens' liquidity to new contracts.

Attacker address:

https://etherscan.io/address/0xfde0d157…81455a

Malicious MEV contract:

https://etherscan.io/address/0xd050e0a4…f3805d

Malicious transaction:

https://etherscan.io/tx/0x192e2f19…1be47f