SquidMulticall exposes a permissionless run() function that executes arbitrary external calls with no access control. When users mistakenly approved tokens directly to SquidMulticall (instead of Squid Router), attackers could call run() with transferFrom() payloads to drain those approvals across multiple chains. A wallet with $623K in infinite approvals was compromised, resulting in $517K extracted.

A user mistakenly approved the SquidMulticall contract (instead of the intended Squid Router contract) with unlimited token allowances. An attacker then called the permissionless run() function on SquidMulticall with crafted calldata to execute transferFrom() from the victim’s approved tokens across multiple chains (ETH, BSC, Arbitrum, Avalanche, etc.). This drained approximately $517K.