# Multichain: forged permit drains NUM via anySwapOutUnderlyingWithPermit

Multichain router's anySwapOutUnderlyingWithPermit accepted forged permit signatures for NUM token, letting attacker drain a victim's NUM balance and swap to USDC.

- Payout: Real-world hack
- Severity: high
- Program: - NUM
- Analysis by: DeFiHackLabs
- Disclosed: 2022-11-23
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2022-11/NUM_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20221123-num
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:access-control vuln:auth-bypass

**Target:** Multichain cross-chain router anySwapOutUnderlyingWithPermit
**Root cause:** The router's permit-based swap path did not properly validate the EIP-2612 permit signature against the token's actual permit implementation, so arbitrary v/r/s values were accepted and the victim's tokens were pulled without consent.
**Steps:**
1. Fork mainnet at block 16029969
2. Read victim NUM balance via `NUM.balanceOf(victimAddress)`
3. Call `multichainRouter.anySwapOutUnderlyingWithPermit(victimAddress, address(this), address(this), NUMBalance, block.timestamp + 60, 0, 0x3078...00, 0x3078...00, 12)` with forged v/r/s
4. Approve Uni Router and swap drained NUM to USDC via `swapExactTokensForTokens(0, 0, [NUM, USDC], address(this))`
**How found:** Likely spotted that the router's permit path did not verify signatures against the token's permit implementation, allowing arbitrary v/r/s to be accepted.
**Exploitation:** Attacker supplied a bogus permit signature (v=0, r=s=0x3078...00) to anySwapOutUnderlyingWithPermit, which pulled the victim's entire NUM balance to the attacker contract; attacker then swapped NUM for USDC on Uniswap V3 router.
**Insight:** Cross-chain routers that wrap token permit calls can skip real signature verification when the underlying token's permit semantics differ; test forged v/r/s against anySwapOutUnderlyingWithPermit-style entrypoints on tokens with non-standard or missing EIP-2612 permit.