SquidMulticall Approval Exploitation Hack

Reported loss $517K
Arbitrum Avalanche Base BNB Chain Optimism
Access Control

What happened

About $517,000 was taken across five chains after a Squid user approved SquidMulticall instead of the intended router. A bot used the helper's permissionless arbitrary-call function to spend assets under that misplaced allowance.

How it happened

  1. The user approved SquidMulticall rather than the intended Squid Router.
  2. A bot detected the allowance and called the helper's permissionless run function with crafted calldata.
  3. The helper executed token transferFrom calls that moved the approved assets from the user's wallet across the affected chains.

Protocol details

Classification Exchange (DEX) / Access Control
Protocol Type Exploit/Access control
Implementation language Solidity
Protocol links Website @squidrouter

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
Ethereum Coinsbuy $8.1M lost Base Third-party SquidRouterModule $3.2M lost Ethereum The R0AR $790K lost BNB Chain XBridge $1.9M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes