Multicall

A multicall bundles several calls into one transaction. The caller passes a list of targets and call data, and the multicall contract runs them in order, usually reverting the whole batch if one fails. Wallets, routers and keeper bots use it to save gas and to make several steps happen atomically.

The security problem

When a multicall contract makes the calls, the targets see the multicall contract as msg.sender, not the person who sent the batch. If a target trusts the multicall contract, for example a wallet module that only obeys its helper, then whoever can drive the multicall inherits that trust.

So a multicall that holds any permission must check who is calling it, not just which targets are in the list. A target allowlist on its own stops calls to the wrong contracts. It does nothing about the wrong caller.

What to check

• Does the multicall contract hold any role, approval or module permission anywhere? If so, it needs a caller check.
• Is the caller check on every entry point, not only the main one?
• Test it from a random address with a call to an approved target. It should revert.