MALT sLP — below-peg recovery deposits treasury DAI into the pair, and `swap` counts it as the caller's input

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-10-MALT_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/MALT_exp.sol.

Vulnerability classes: vuln/logic/missing-check · vuln/logic/incorrect-order-of-operations · vuln/defi/price-manipulation Reproduction: the PoC compiles and runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Offline pass. anvil_state.json is present. The trace forks <rpc url> at block 94,869,209 output.txt:362 and [PASS] testExploit finishes in 75.71ms output.txt:1530.

Key info#

TL;DR#

The MALT stablecoin's own market is a Uniswap V2-style pair (token0 = MALT, token1 = DAI) whose swap is not the stock two-step pair. Before it pays amount0Out / amount1Out it calls 0xf61AB339…b34b101f. When MALT is under peg that path asks RewardThrottle 0x6f96483f… to pull DAI from the Capital Source into the pair. The pair then applies the K check to balances that include that deposit, and it charges its 0.1% fee on the caller's specified output.

The attacker does not call the treasury. They sell MALT into the sLP so the price is under peg, transfer 1 DAI in, and swap out a much larger MALT amount. Round 1: treasury 6,286.101126094517384766 DAI output.txt:621, MALT out 7,823.544 output.txt:738. Round 2: treasury 6,458.543380496071751952 DAI output.txt:1029, MALT out 8,229.254 output.txt:1182. Each MALT stack is sold on QuickSwap for DAI. A third round does not touch the Capital Source. Flash repay is 1,300 DAI output.txt:1503. Profit 13,440.581562307921517594 DAI output.txt:358.

Background#

MALT is meant to trade near 1 DAI. The sLP is the protocol pool. A separate QuickSwap MALT/DAI pair 0xF864Db3e…3cE1 is the outside market the attacker buys and sells on, through router 0xa5E0829C…78ff. Balancer V2 Vault 0xBA122222…F2C8 is the flash source. Fee on this Polygon flash is 0: the repay is exactly 1,300 DAI.

swap on the sLP takes (amount0Out, amount1Out, to) and no callback bytes. The caller must transfer the input token first (standard V2). The pair reads both balances, calls the recovery, sends the output, takes a 0.1% fee to profitDistributor() 0x5c2152a8…f369 output.txt:747, and syncs. The 0.1% is visible on the first sell: requested DAI out 2,047.278, transferred to the attacker 2,045.230722, fee 2.047278 output.txt:475, output.txt:492, output.txt:502. 2.047278 / 2,047.278 = 0.001.

The verified MALT token under sources/Malt_16c8cd/ is an ERC20 with a transfer verifier. It does not implement swap and it does not hold the Capital Source. Fetching 0xfe6C09… and 0xF0d314… both returned UNVERIFIED. The control flow below is the call tree in output.txt, not a decompiled listing pasted as source.

The PoC is test/MALT_exp.sol. Per-leg amounts are the historical ones: round 1 buy 1,300 DAI, sLP DAI out 2,047.278, exploit MALT out 7,823.544; round 2 buy 2,850 DAI, sLP DAI out 6,459.541, exploit MALT out 8,229.254; round 3 buy 2,850 DAI, sLP DAI out 6,455.961, exploit MALT out 120.748, with 50 DAI transferred in. Decimals are 18. The test writes those as 1_300e18, 2_047_278e15, 7_823_544e15, and so on.

The vulnerable code#

RECONSTRUCTED from output.txt. Not verified source.

// sLP 0xfe6C096a…  selector 0x6d9a640a
function swap(uint256 amount0Out, uint256 amount1Out, address to) external {
    // balances already include whatever the caller transferred in
    uint256 bal0 = MALT.balanceOf(address(this));
    uint256 bal1 = DAI.balanceOf(address(this));

    // below peg: recovery may transfer DAI CapitalSource -> this pair
    // trace: 0xf61AB339.b34b101f -> RewardThrottle 0x6f96483f.cc99bba5
    //        -> CapitalSource.19dc30ba(DAI, amount, sLP)
    IRecovery(0xf61AB33917fd056bB7dDd4F474a237928f63d5d6).b34b101f(...);

    // output is paid, 0.1% fee goes to profitDistributor, then K is checked
    // on the FINAL balances. Treasury DAI just received counts as input.
    if (amount0Out > 0) MALT.transfer(to, amount0Out);
    if (amount1Out > 0) DAI.transfer(to, amount1Out);
    // require(balance0 * balance1 >= reserve0 * reserve1) using balances
    // that now include the Capital Source deposit
}

Round 1 exploit swap, the call that matters, in order:

• Caller has already transferred 1 DAI output.txt:545. sLP DAI balance before the recovery is 2,632.155765831136241737 output.txt:560.
• 0xf61AB339.b34b101f output.txt:564. It checks isPair(sLP) output.txt:565, reads prices, then RewardThrottle.cc99bba5 output.txt:607.
• CapitalSource.19dc30ba(DAI, 6286101126094517384766, sLP) transfers 6,286.101126094517384766 DAI from 0xF0d314… to the pair output.txt:618, output.txt:621.
• The pair then transfers 7,823.544 MALT to the attacker output.txt:738 and 0.001 DAI to the fee recipient output.txt:748. The 1 DAI input was not the K input that made 7,823.544 MALT legal. The 6,286 DAI deposit was.

Round 2 repeats the same selectors with 6,458.543380496071751952 DAI output.txt:1026, output.txt:1029 and 8,229.254 MALT out (Swap event output.txt:1182). The trace contains exactly two 19dc30ba calls. Round 3's swap does not call the Capital Source.

Root cause#

1. The invariant is applied after an exogenous deposit. Constant product is supposed to compare reserves with balances that changed only by the swap's own input and output. DAI that the recovery pushed in raises balance1 with no matching reduction of amount1Out and no matching "this DAI is not the caller's". The check passes, and the MALT output is released.
2. The recovery is on the public swap path. Selling MALT into the pool is enough to get under peg. There is no keeper window and no msg.sender allowlist on swap. The Capital Source pays because the pair (via RewardThrottle) is an authorized allocator, which the trace shows as allocation(...) before the pull output.txt:612, output.txt:1020. The attacker never calls 19dc30ba.
3. Input size is not related to output size by the caller's tokens alone. 1 DAI in, 7,823.544 MALT out, is only possible because 6,286 DAI arrived from the treasury in the middle. A correct implementation would snapshot balanceOf before the recovery, or exclude tokens received from the Capital Source during this call, and would revert if amountOut is not backed by the caller's delta.
4. The 0.1% fee does not fix it. The fee is a slice of the specified output (or of the input, on the buy leg). It is not a check that the caller funded the input the curve assumed.

Preconditions#

• Permissionless surface. Balancer flashLoan, QuickSwap swapExactTokensForTokens (amountOutMin = 0 in the PoC), sLP transfer + swap. No owner, timelock, or keeper call in the attacker's path.
• Capital Source must still allocate DAI to this RewardThrottle. Round 1 pull 6,286.101126094517384766. Round 2 pull 6,458.543380496071751952. If allocation were 0 the recovery would not fund the K check and the large amount0Out would revert.
• The sLP must be movable under peg by a sell the attacker can fund. The PoC manufactures that with the flash and the QuickSwap inventory. It does not wait for an existing depeg.
• 1,300 DAI flash, fee 0. Repay output.txt:1503 is 1300000000000000000000 and feeAmounts added nothing (the transfer equals the principal).
• No MALT or DAI balance at the start. The contract is deployed empty in setUp and funded only by the vault.

Attack walkthrough (with on-chain numbers from the trace)#

DAI identity

6,286.101126094517384766 + 6,458.543380496071751952 = 12,744.644506590589136718. 13,440.581562307921517594 − 12,744.644506590589136718 = 695.937055717332380876. The residual is real arithmetic on the trace totals; the PoC does not log it as its own line. [PASS] testExploit at output.txt:355. Suite: 1 passed in 75.71ms output.txt:1530.

Diagrams#

Remediation#

1. Snapshot balances before the recovery and do not let recovery deposits satisfy K. If the protocol must inject DAI, account for it as a reserve increase that is paired with an explicit MALT burn or a rebase, not as amountIn of the swapper who happened to be in the function.
2. Run the invariant on the caller's delta only. amountIn = balanceAfterTransfer - reserve, measured before any treasury transfer. Revert when amountOut is not paid for by that delta under the fee.
3. Separate the keeper entrypoint from swap. A public swap should not be able to decide that the treasury sends DAI. If a rebalance is required, a permissioned caller should move the reserves in a transaction that does not also pay a user-specified amountOut.
4. Cap the pull. allocation is an upper bound the throttle already reads output.txt:612. The pair should still refuse to treat any of it as swap input. A per-block cap does not fix the accounting; it only limits the loss.
5. Verify the sLP and the Capital Source. The token is verified and is not where the DAI is released. The contracts that move the treasury are the ones that were not verified.

How to reproduce#

Offline, from the committed state. _shared/run_poc.sh loads anvil_state.json, starts anvil, and rewrites the test's http://127.0.0.1:8549 URL.

# from the registry root
_shared/run_poc.sh 2026-10-MALT_exp -vvvvv

• Chain / fork: Polygon, block 94,869,209 (parent of attack block 94,869,210). The test forks http://127.0.0.1:8549.
• Committed result in output.txt (finished in 75.71ms):

[PASS] testExploit()
MALT - treasury-funded rebalance counted as the caller's swap input
Attacker DAI profit after flash-loan repay: 13440.581562307921517594
Suite result: ok. 1 passed; 0 failed; 0 skipped

Reference: attack tx in the header of test/MALT_exp.sol — 0x915eccb5791508aa89a0a3f1385b26346b127ebb648b046e4cb558474ce8445b. The test's fork URL is http://127.0.0.1:8549.

References#

• https://x.com/SlowMist_Team/status/2106418632041668784 (@SlowMist_Team secondary analysis)

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-10-MALT_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: MALT_exp.sol.
• Attack transaction: view on explorer.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "MALT sLP".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.