Submitted by gzeon
One of the innovative feature of Malt is to block buying while under peg. The buy block can be bypassed by swapping to the whitelisted UniswapHandler, and then extract the token by abusing the add and remove liquidity function. This is considered a high severity issue because it undermine to protocols ability to generate profit by the privileged role as designed and allow potential risk-free MEV.
swapExactTokensForTokens(amountDai, 0, [dai.address, malt.address], uniswapHandler.address, new Date().getTime() + 10000);
2) User send matching amount of dai to uniswapHandler
3) User call addLiquidity() and get back LP token
4) User call removeLiquidity() and get back both dai and malt
According to documentation in https://github.com/code-423n4/2021-11-malt#high-level-overview-of-the-malt-protocol
, this should be exploitable. Meanwhile the current implementation did not actually allow remove liquidity during recovery mode (refer to issue Unable to remove liquidity in Recovery Mode)
This exploit can be mitigated by disabling addLiquidity() when the protocol is in recovery mode
0xScotch (sponsor) confirmed
Alex the Entreprenerd (judge) commented:
Alex the Entreprenerd (judge) commented:
