# Multichain AnyswapV4Router: insufficient token validation drains WETH

Multichain AnyswapV4Router's anySwapOutUnderlyingWithPermit lacked token validation, letting attacker spoof a token contract to drain WETH via fake burn/depositVault.

- Payout: Real-world hack
- Severity: critical
- Program: Multichain (Anyswap)
- Analysis by: DeFiHackLabs
- Disclosed: 2022-01-18
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-01/Anyswap_exp.sol
- Library page: http://bugbountylibrary.com/r/dhl%3A20220118-anyswap
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:source-review vuln:access-control vuln:business-logic

**Target:** AnyswapV4Router anySwapOutUnderlyingWithPermit
**Root cause:** The router trusted the caller-supplied token address and called underlying(), burn(), and depositVault() on it without verifying it was a legitimate bridge token, so an attacker contract could return WETH as underlying and no-op the burn.
**Steps:**
1. Deploy attacker contract implementing underlying() returning WETH, burn() returning true, and depositVault() returning 1.
2. Call `anySwapOutUnderlyingWithPermit(0x3Ee505bA316879d246a8fD2b3d7eE63b51B44FAB, address(this), msg.sender, 308636644758370382903, 100000000000000000000, 0, "0x", "0x", 56)` on AnyswapV4Router at 0x6b7a87899490EcE95443e979cA9485CBE7E71522.
3. Router calls underlying() on attacker token, gets WETH, then calls burn()/depositVault() which are no-ops, and transfers WETH to attacker.
4. Transfer drained WETH to msg.sender.
**Exploitation:** Attacker contract passed itself as the token argument; router resolved underlying to WETH and released WETH without burning real tokens, netting ~308.6 WETH.
**Insight:** Bridge routers that accept arbitrary token addresses and call methods like underlying()/burn() on them can be tricked with a fake token contract that returns a valuable underlying asset while no-oping the burn.