# SquidMulticall: arbitrary call drains victim token approvals

SquidMulticall.run executes arbitrary calls, letting anyone spend victim approvals to transferFrom tokens; 1 ETH drained, ~$800K at risk.

- Payout: Real-world hack
- Severity: high
- Program: SquidMulticallAllowanceDrain
- Credited: DefimonAlerts
- Disclosed: 2026-04-07
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/SquidMulticallAllowanceDrain_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260407-squidmulticallallowancedrain
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm technique:source-review vuln:access-control vuln:business-logic

**Target:** SquidMulticall contract on BSC
**Root cause:** SquidMulticall.run is callable by anyone and executes arbitrary target/callData without restricting the caller or validating that the call is part of an intended swap, so it can invoke transferFrom on tokens the victim approved to the contract.
**Steps:**
1. Victim approves SquidMulticall (0xad6c...d2f4) for max allowance on Binance-Peg ETH (0x2170...f933f8).
2. Attacker builds `Call[]` with one entry: `callType=Default, target=ETH_TOKEN, value=0, callData=abi.encodeCall(IERC20.transferFrom,(VICTIM,ATTACKER,1 ether)), payload=""`.
3. Attacker calls `ISquidMulticall(SQUID_MULTICALL).run(calls)`.
4. SquidMulticall executes `ETH_TOKEN.transferFrom(VICTIM, ATTACKER, 1 ether)`, spending the victim's allowance.
**How found:** Likely spotted that SquidMulticall.run is permissionless and forwards arbitrary callData to arbitrary targets, then checked on-chain for victims with large approvals to the contract.
**Exploitation:** Attacker directly invoked SquidMulticall.run with a crafted Default call targeting the token contract and transferFrom(victim, attacker, amount). Because the victim had approved SquidMulticall, the contract's call succeeded and moved 1 ETH to the attacker. The same primitive could drain any token the victim approved to SquidMulticall; ~$800K of cross-chain approvals were at risk and ~$512K was later rescued.
**Escalation:** Any token with an outstanding approval to SquidMulticall could be drained by repeating the call per token; cross-chain approvals expanded the at-risk amount to ~$800K.
**Insight:** When a router/multicall contract holds user approvals, test whether its entrypoint is permissionless and whether callData/target are fully attacker-controlled; a single Default call to transferFrom is enough to monetize existing allowances.