mediumLogic errorEVM-Solidity
Malda: Blacklist can be completely bypassed on outHere endpoint in mTokenGateway
- Payout
- $0
- Protocol
- Malda
- Disclosed
- Aug 14, 2025
- Source
- sherlock
Malda's mTokenGateway exposes an `outHere` function for cross-chain mToken withdrawals, guarded by `ifNotBlacklisted` modifiers on both the caller and receiver. Both guards are neutralized: the caller check is bypassed because any `allowedCallers` address can …
Similar reports
- No close matches yet.
References
This report is already public and closed. CoinBuggie never publishes active or unpatched vulnerability data.