OAK — OnChain Attack Knowledge

Worked example · 2026-10

MALT — the swap's own rebalancing pulled DAI from the treasury, and the swap counted it as the trader's payment — MALT / EVM — 2026-10-03

Loss
~$72K. The project says the flaw is fixed and affected users will be compensated.
OAK Techniques observed
OAK-T9.016 (Contract Accounting / State-Invariant Flaw — primary, per SlowMist. During a swap, rebalancing withdrew DAI from MALT's Capital Source and returned it to the pool; the swap's invariant check then read post-hook balances and treated that treasury DAI as caller-supplied input, so a small input bought out-sized MALT. See techniques/T9.016-contract-accounting-state-invariant-flaw.md).
Re-mapped 2026-10-11
primary Technique moved from T9.004 to T9.016-contract-accounting-state-invariant-flaw.
Attribution
pseudonymous.
Key teaching point
Measure what the trader paid before anything else touches the balance. An invariant checked after an internal hook can be satisfied by the protocol's own money.

Summary

On 2026-10-03 an attacker made small-input swaps on MALT that triggered rebalancing from the Capital Source; the treasury DAI returned to the pool was counted toward the swap's input check, letting the attacker take out more MALT than paid for. Losses were ~$72K; the project patched and pledged compensation.

Root-cause evidence

  • Technique: OAK-T9.016
  • Source: https://x.com/SlowMist_Team/status/2106418632041668784
  • Source type: security-firm
  • Confidence: reported
  • Evidence: SlowMist: rebalancing inside a swap pulled DAI from the Capital Source into the pool and the swap's validity check counted it as trader input. The project acknowledged a fix but published no analysis.

Public references

Techniques demonstrated (1)