mediumInteger overflow/underflowEVM-Solidity
Malda: Wrong direction of rounding in redeem may lead to drain if exchange rate grows large
- Payout
- $0
- Protocol
- Malda
- Disclosed
- Aug 14, 2025
- Source
- sherlock
The mToken contract, a Compound v2 fork, rounds the redeemUnderlying division by exchange rate downward instead of upward, withdrawing fewer shares from the user than the underlying amount warrants. While the per-call loss is only ~1 wei of shares, a first dep …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.