Incident Overview
On October 7, 2025, Squid Router contracts across multiple chains (BSC, Ethereum, Arbitrum, Base, and Optimism) were exploited for approximately $90,000+ due to a simple logic bug in the sponsorOrderUsingPermit2() function. Multiple attackers, some funded through Tornado Cash, drained USDT and USDC tokens by exploiting incorrect token variable handling in the contract's permit2 implementation.
The vulnerability existed in the sponsorOrderUsingPermit2() function, which allows users to create orders using offline-signed permit2 signatures. The critical flaw was that the function incorrectly used the token variable from the permit data structure instead of the from token specified in the order structure. This mismatch allowed attackers to manipulate which tokens were transferred, enabling unauthorized drainage of contract funds.
In contrast, the createOrder() and sponsorOrder() functions correctly used tokens from the order data structure, highlighting this as an isolated implementation bug. The exploit was executed across five blockchains with varying losses: BSC ($38,000), Ethereum ($21,000), Arbitrum ($22,000), Base ($8,000), and Optimism (~$3,000). Multiple attackers participated, including MEV bots and Tornado Cash-funded addresses, suggesting the vulnerability was quickly identified and exploited by different actors.
BSC Attacks:
Primary attacker: 0xc6e8210e…48868e
Secondary attacker: 0xf49632e3…5e4543
Ethereum Attackers:
Arbitrum:
Attacker: 0x8586df40…493c03
Optimism:
Attacker: 0x1acc6fc2…d4272f
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Squid, these are the critical security checks that could have prevented this incident (October 2025).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Squid
The Squid hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.