SquidMulticall

SquidMulticall exposes a permissionless run() function that executes arbitrary external calls with no access control. When users mistakenly approved tokens directly to SquidMulticall (instead of Squid Router), attackers could call run() with transferFrom() payloads to drain those approvals across multiple chains.

A wallet with $623K in infinite approvals was compromised, resulting in $517K extracted.