Malda — disclosed vulnerability reports and payouts
Every publicly disclosed and closed bug bounty report we hold for Malda, with our own summary of each finding and a link to the original disclosure.
- Reports indexed
- 3
- Total paid
- $0
- Critical
- 0
- Largest payout
- $0
This page collects the 3 closed, publicly disclosed Malda reports indexed on Coin Buggie. Nothing here is active or unpatched — every entry was published by the programme or the researcher after remediation.
The findings concentrate in Integer overflow / underflow, Logic error, Bridge exploit, across EVM-Solidity. Reading a single protocol end to end is the fastest way to see which assumptions its codebase repeatedly gets wrong, which is usually a better predictor of where the next finding lives than the category alone.
Use the vulnerability class links below to compare these findings against the same bug class in other protocols.
What reviewers look for
- Integer overflow / underflow findings disclosed against Malda
- Logic error findings disclosed against Malda
- Bridge exploit findings disclosed against Malda
Curated highlights
The largest disclosed payouts in this group, with our own summary of each. Every report links back to the original disclosure.
Malda: Wrong direction of rounding in redeem may lead to drain if exchange rate grows large
The mToken contract, a Compound v2 fork, rounds the redeemUnderlying division by exchange rate downward instead of upward, withdrawing fewer shares from the user than the underlying amount warrants. While the per-call loss is only ~1 wei of shares, a first depositor can leverage this rounding during both mint and redeem when supply is zero to inflate the exchange rate by an arbitrary factor — first linearly (repeated 1-wei mints with zero-value redeems reaching ~exp), then exponentially by donating tokens that mint zero shares. Once the exchange rate hits a target like 1e6×exp, redeemUnderlying can drain arbitrary underlying while burning zero shares, stealing all new depositor funds.
Malda: There is no endpoint for triggering `liquidateExternal` from extension chain to be executed by proof forwarder
Malda's cross-chain lending design lets liquidity from extension chains be routed to the host chain for liquidations via mErcHost.liquidateExternal, but the mTokenGateway that initiates these cross-chain actions exposes only supplyOnHost, which carries a Linea function selector without any borrower parameter. As a result there is no permissionless way to trigger a liquidation from an extension chain such as Ethereum mainnet, so undercollateralized positions that require such a cross-chain call may go unliquidated. The fix added a liquidateOnHost endpoint to mTokenGateway and had the BatchSubmitter handle the new selector, which was confirmed by the reporting judge.
Malda: Rebalancer can send to unallowed destination chains through EverclearBridge
Malda's rebalancer constructs an Everclear bridge intent from an attacker-influenceable message, and the target EverclearBridge validation only verifies that at least one entry in the destinations array equals the chain id passed to sendMsg. Because the full destinations list is used to create the Everclear intent, the intent can be fulfilled on any listed chain, including ones Malda does not handle, which permanently strands the bridged funds. The finding was acknowledged by the protocol and fixed by restricting the destinations list to a single entry equal to _dstChainId.