Beosin: Multichain's AnyswapV4Router contract was attacked by a front-running attack, and the attacker made a profit of about 130,000 US dollars

According to the Beosin EagleEye security risk monitoring, early warning and blocking platform monitoring of the blockchain security audit company Beosin, the AnyswapV4Router contract of Multichain was attacked by a rush attack. On February 15, 2023, the attacker used the MEV contract (0xd050) in the normal Before the transaction is executed (the user has authorized WETH but has not yet made the transfer), the anySwapOutUnderlyingWithPermit function of the AnyswapV4Router contract is called first to perform the signature authorization transfer. Although the function uses the token’s permit signature verification, the stolen WETH is not relevant. The signature verification function only triggers the deposit function in a fallback. In the subsequent function calls, the attacker can directly use the safeTransferFrom function to transfer the WETH authorized by the _underlying address to the attacked contract to the attack contract without signature verification. The attacker made a profit of about 87 Ethereum, which is about $130,000. According to Beosin Trace, about 70 Ethereum of the stolen funds have entered the 0x690b address, and about 17 Ethereum are still in the contract of MEVBOT.