SquidMulticallAllowanceDrain exploit analysis
SquidMulticall aggregated token approvals across users, and an attacker-supplied target called `transferFrom` against the aggregated allowance. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- 1 ETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-07: Arbitrary Call Wrong Approval on SquidMulticallAllowanceDrain”.
Analysis1 min read
SquidMulticall was a helper that approved a target allowance for msg.sender's tokens, then ran the target's call. The attacker supplied a target that called transferFrom against the helper's aggregated approvals and drained each user's allowance.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: an allowance approve path that pins the approved spender to the call the helper is about to run, not an aggregated all-purpose allowance.
Other exploits
- MONA LisaVault exploit analysis 14 Apr 2026
- Saturn Protocol exploit analysis 14 Apr 2026
- SubQuerySettings exploit analysis 12 Apr 2026
- PerpPair exploit analysis 5 Apr 2026
- WhalebitOracleManipulation exploit analysis 31 Mar 2026
- VTSwapHook exploit analysis 28 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
