Slow Fog: Brief analysis of Multichain vulnerability attack events

Slow fog

A critical vulnerability affecting 6 cross-chain tokens is being exploited, according to Multichain(AnySwap). The slow Fog security team will analyze it and share it with you in the form of SMS.

1. The user can perform fund cross-chain operation through the Anyswap V4 Router contract of Multichain. In the cross-chain operation, the user needs to authorize the Token to be cross-chain to the Anyswap V4 Router contract.

2. The Anyswap V4 Router has the Anyswap Out Permit function. This function allows the user to perform an authorization signature, on-chain authentication, and authorization operations. In this function, it obtains the underlying Token address by calling the function of the Token address passed in by the user. (Normally, the Token address passed in by the user should be anyToken.) Get physicist Token should be user to cross chain assets, such as anyUSDT and USDT), followed by physicist Token Permit function signature check and authorization operation, After authorization is completed, the Token is transferred into anyToken contract through safeTransfer From. Finally, the event is triggered through _anySwapOut.

3. However, since the anySwap Out With Permit function does not check the validity of tokens passed in by users, and the Fallback function is implemented while the Permit function does not exist in WETH Token, The Permit function interface also happens to have no return value, so no error will be thrown when the Permit function of the contract WETH is called. The attacker uses this problem to construct a malicious Token address, which makes the value obtained by the anySwap Out With Permit function equal force to WETH, Transfer WETH of the user who previously authorized the Token to the Anyswap V4 Router contract directly to the Token address maliciously constructed by the attacker.

The Underlying cause is that the anySwap Out With Permit function checks the validity of tokens passed in by users, and not all tokens implement the Permit function, resulting in unauthorized transfer of user assets. The slow Fog security team recommends: Check whether the parameters sent by users meet expectations, and consider compatibility issues when interconnecting with other contracts.

Reference transaction :& NBSP;https://etherscan.io/tx/0xd07c0f40eec44f7674dddf617cbdec4758f258b531e99b18b8ee3b3b95885e7d

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia