SlowMist (@SlowMist_Team) “🚨SlowMist TI Alert🚨 💸 MALT Loss: ~$72k 🔍 Root Cause: swap(uint256,uint256,ad” — TopicDigg

🚨SlowMist TI Alert🚨 💸 MALT Loss: ~$72k 🔍 Root Cause: swap(uint256,uint256,address) records the caller’s input and pre-swap reserves, then invokes an external rebalanceHook before transferring the requested output. The hook withdraws DAI from the Capital Source and deposits it into the same pool. The swap subsequently validates its invariant against the pool’s final balances, treating this protocol-funded DAI as if it were supplied by the caller. Because the function does not isolate caller-funded input from hook-funded rebalancing capital, an attacker can provide negligible input, trigger treasury-funded liquidity injection, and withdraw a disproportionate amount of MALT. 📌 Attacker: 0x8F103B6A0aD705bcE6357842A5fefEB49e8D83Ef 📌 Victim: 0xF0d314849A3Bc9270a79110F25dBA2c8325A2AAC 📌 Vulnerable Contract: 0xfe6C096a2871337d4f6F7DD04Ebda733E94D7A13 Powered by Tx: