# MulticallWithoutCheck: arbitrary call drains contract USDT

MulticallWithoutCheck contract on Polygon executed arbitrary external calls, letting an attacker transfer the contract's entire USDT balance to themselves.

- Payout: Real-world hack
- Severity: critical
- Program: MulticallWithoutCheck
- Analysis by: DeFiHackLabs
- Disclosed: 2022-10-24
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-10/MulticallWithoutCheck_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221024-multicallwithoutcheck
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity vuln:access-control vuln:business-logic

**Target:** MulticallWithoutCheck contract on Polygon (0x940cE652A51EBadB5dF09d605dBEDA95fDcF697b)
**Root cause:** multicallWithoutCheck accepts a Call[] array and executes each entry's target/callData without validating that the target is trusted or that the call is safe, so any caller can invoke arbitrary functions on arbitrary contracts from the contract's context.
**Steps:**
1. Fork Polygon at block 34743770.
2. Read USDT balance held by target 0x940cE652A51EBadB5dF09d605dBEDA95fDcF697b.
3. Build callData `transfer(address,uint256)` with attacker address and full USDT balance.
4. Wrap in Call{target: USDT, callData: data, value: 0} and pass as single-element Call[] to `multicallWithoutCheck(calls)`.
5. Contract executes USDT.transfer, sending its balance to the attacker.
**Exploitation:** Attacker calls multicallWithoutCheck with a single Call targeting the USDT token and calldata for transfer(attacker, contractBalance). Because the contract performs the call without checking the target, USDT is transferred from the contract to the attacker in one transaction.
**Insight:** Any multicall/aggregator that forwards arbitrary target+calldata must whitelist targets or restrict to self-calls; otherwise the contract's own token balances and approvals become drainable via a single crafted Call entry.