SquidRouterModule exploit analysis
SquidRouterModule, a Gnosis Safe module wrapping Axelar's `AxelarExpressExecutableWithToken`, accepted a crafted Squid message whose `validateProof` allowed arbitrary approve/transfer. DeFiHackLabs reconstructs the in-tx drain of 0.25 WBTC plus 0.29 wTAO plus 0.02 WETH.
- Reported loss
- 0.25 WBTC + 0.29 wTAO + 0.02 WETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-25: Missing Caller Check on SquidRouterModule”.
Analysis1 min read
SquidRouterModule is a Gnosis Safe module that lets a whitelisted Squid/Axelar bridge message run swap/approve actions on a Safe. It inherits Axelar's AxelarExpressExecutableWithToken, which validates an Axelar payload via validateProof. A misconfigured call allowed an attacker to construct a payload that the contract accepted as a whitelisted Squid message, allowing arbitrary approval/transfer on the Safe.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0x2d52984706d5ac567d554d40a62beeeda9e3901dd3847e93dd2a3117902abfeb on Etherscan for a total loss of 0.25 WBTC plus 0.29 wTAO plus 0.02 WETH.
What would have prevented it: a validateProof that strictly parses the caller payload and only allows the message shapes the Safe's role/admin policy can approve.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260525-squidroutermodule---inherited-axelar-payload-validation-flaw
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/SquidRouterModule_exp.sol
- https://etherscan.io/tx/0x2d52984706d5ac567d554d40a62beeeda9e3901dd3847e93dd2a3117902abfeb
Other exploits
- Joe Agent exploit analysis 27 May 2026
- SKP Token exploit analysis 26 May 2026
- New Market Trading exploit analysis 25 May 2026
- WUSD.fi exploit analysis 25 May 2026
- FractalProtocol exploit analysis 22 May 2026
- MureDistribution exploit analysis 21 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
