MALT Loses $72,000 in Swap Exploit Tapping Treasury DAI

MALT lost about $72,000 after an attacker exploited a flaw in its swap function, according to a report published Oct. 3 by security firm SlowMist. The attacker used a small amount of input to trigger the faulty swap and receive more MALT than the transaction should have allowed.

The vulnerability affected MALT’s swap(uint256,uint256,address) function. The function recorded the trader’s input and the pool’s reserves before calling an external rebalancing function.

During rebalancing, the function withdrew DAI from MALT’s Capital Source and returned it to the pool. The swap then counted that treasury-funded DAI during its validity check, even though the funds had not come from the trader.

The flaw did not distinguish between user-supplied funds and capital added during rebalancing. This allowed the attacker to provide limited input, benefit from additional DAI supplied by MALT’s treasury and withdraw excess MALT.

The incident followed an Oct. 1 exploit affecting NEAR Intents, which caused about $3.8 million in losses and led the project to halt its services. The project reported that it had fixed the contract flaw and would compensate affected users.

A separate exploit targeting the FlashLoopAdapter drained about $305,000 from two Safe wallets using Aave V3 positions. The attack affected the custom module rather than Aave V3’s core contracts.

Data from DeFiLlama shows that hacks across decentralized finance projects have caused more than $21 billion in losses. DeFi protocols accounted for about $9.28 billion, while blockchain bridges accounted for approximately $3.69 billion.