User can bypass Recovery Mode via UniswapHandler to buy Malt

Handle gzeon Vulnerability details Impact One of the innovative feature of Malt is to block buying while under peg. The buy block can be bypassed by swapping to the whitelisted UniswapHandler, and then extract the token by abusing the add and remove liquidity function. This is considered a high...

Slippage checks when adding liquidity are too strict

Handle cmichel Vulnerability details When adding liquidity through UniswapHandler.addLiquidity, the entire contract balances are used to add liquidity and the min amounts are set to 95% of these balances. If the balances in this contract are unbalanced the ratio is not similar to the current...

Missing slippage/min-return check in UniswapHandler

Handle cmichel Vulnerability details The contracts are missing slippage checks which can lead to being vulnerable to sandwich attacks. A common attack in DeFi is the sandwich attack. Upon observing a trade of asset X for asset Y, an attacker frontruns the victim trade by also buying asset Y, lets...

UniswapHandler.maltMarketPrice returns wrong decimals

Handle cmichel Vulnerability details The UniswapHandler.maltMarketPrice function returns a tuple of the price and the decimals of the price. However, the returned decimals do not match the computed price for the else if rewardDecimals maltDecimals branch: else if rewardDecimals maltDecimals uint2...

UniswapHandler vulnerable to sandwich bots

Handle Koustre Vulnerability details Impact Any user or contract that has the buyer role that uses the functions buyMalt and sellMalt will be vulnerable to sandwich attacks from bots that will causes slippage loses to users. Proof of Concept Provide direct links to all referenced code in GitHub...

Unable to remove liquidity in Recovery Mode

Handle gzeon Vulnerability details Impact According to When the Malt price TWAP drops below a specified threshold eg 2% below peg then the protocol will revert any transaction that tries to remove Malt from the AMM pool ie buying Malt or removing liquidity. Users wanting to remove liquidity can...

Anyone can remove liquidity

Handle jayjonah8 Vulnerability details Impact In UniswapHandler.sol, anyone can call the removeLiquidity function stealing all the lp tokens in the contract even if they never added liquidity in the first place since the function simply credits the msg.sender with the entire lp token balance of t...