Leaderboard
571All-time rank
Multichain
Jan 18, 2022
$1.4M
Lost
$1.4M
Recovered
$0
Net loss
$1.4M
Unrecovered0% recovered
Multichain's token contracts for WETH, PERI, OMT, WBNB, MATIC, and AVAX lacked proper validation of ERC20 permit() function calls. An attacker exploited this vulnerability to steal tokens from users who had previously granted approvals.
A white-hat responder later returned approximately $1M of the $3M total loss, retaining 62 ETH as a bounty.
How the exploit worked
View reproducible PoCInsufficient Token Validation.
Lost: $1.4 million
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Input Validation
- Technique
- Missing Input Validation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jan 18, 2022Exploit executed — $1.4M drained via missing input validation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)
