Logic Flaw Exploited in MALT's Swap Function Leads to $72,000 Loss
An attacker exploited a logic flaw in MALT's swap function, resulting in a significant loss. The incident involved a manipulation of the protocol's Capital Source and treasury funds.
An attacker exploited a logic flaw in MALT’s swap function, which allowed them to trigger an external rebalanceHook with negligible input. This action pulled DAI from the protocol’s Capital Source into the same pool, leading to a manipulation of the swap process. The swap then incorrectly checked its invariant against the post-hook balances, treating the treasury-funded DAI as if it were supplied by the caller.
As a result of this exploitation, the attacker was able to withdraw a disproportionate amount of MALT tokens, leading to a loss of approximately $72,000. The specific chain involved in this incident has not been stated, which limits the ability to trace the transaction on-chain.
The on-chain record does not provide specific addresses related to this incident, but the mechanics of the exploit highlight a vulnerability in the swap function's logic. This incident emphasizes the need for thorough testing and auditing of smart contract functions to prevent similar occurrences.